Edit tour

Windows Analysis Report
SOA Payment for June 30th.exe

Overview

General Information

Sample name:	SOA Payment for June 30th.exe
Analysis ID:	1467838
MD5:	63128eeca6e0dabeddfd68c0517d4c91
SHA1:	eb43eb41464d255d312b6b2aa14428ccd16156da
SHA256:	45d0c2ec2ede02e8b8ef535346a4e7e06fd52ba27995a15a5f1a0b11e305d4f7
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SOA Payment for June 30th.exe (PID: 1576 cmdline: "C:\Users\user\Desktop\SOA Payment for June 30th.exe" MD5: 63128EECA6E0DABEDDFD68C0517D4C91)

SOA Payment for June 30th.exe (PID: 6408 cmdline: "C:\Users\user\Desktop\SOA Payment for June 30th.exe" MD5: 63128EECA6E0DABEDDFD68C0517D4C91)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "nffplp.com", "Username": "airlet@nffplp.com", "Password": "$Nke%8XIIDtm"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.4599301189.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4599301189.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4599301189.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SOA Payment for June 30th.exe PID: 1576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SOA Payment for June 30th.exe PID: 1576	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SOA Payment for June 30th.exe PID: 1576	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SOA Payment for June 30th.exe PID: 6408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SOA Payment for June 30th.exe PID: 6408	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.SOA Payment for June 30th.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.SOA Payment for June 30th.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.SOA Payment for June 30th.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.SOA Payment for June 30th.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x340ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34161:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x341eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3427d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x342e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34359:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x343ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3447f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SOA Payment for June 30th.exe.47c6078.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SOA Payment for June 30th.exe.47c6078.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SOA Payment for June 30th.exe.47c6078.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x322ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32361:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x323eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3247d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x324e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32559:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x325ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3267f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SOA Payment for June 30th.exe.4801698.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SOA Payment for June 30th.exe.4801698.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SOA Payment for June 30th.exe.4801698.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x322ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32361:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x323eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3247d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x324e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32559:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x325ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3267f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x340ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f50f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34161:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f581:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x341eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f60b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3427d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f69d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x342e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f707:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34359:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f779:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x343ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f80f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3447f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6f89f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x340ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f70f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaab2f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34161:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f781:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xaaba1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x341eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f80b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xaac2b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3427d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f89d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xaacbd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x342e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f907:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaad27:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34359:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f979:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaad99:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x343ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fa0f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xaae2f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 163.44.198.71, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\SOA Payment for June 30th.exe, Initiated: true, ProcessId: 6408, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49715

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3.2.SOA Payment for June 30th.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "nffplp.com", "Username": "airlet@nffplp.com", "Password": "$Nke%8XIIDtm"}

Multi AV Scanner detection for submitted file

Source: SOA Payment for June 30th.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SOA Payment for June 30th.exe

Joe Sandbox ML: detected

Source: SOA Payment for June 30th.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SOA Payment for June 30th.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: dhSR.pdbSHA256 source: SOA Payment for June 30th.exe
Source:	Binary string: dhSR.pdb source: SOA Payment for June 30th.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.SOA Payment for June 30th.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49715 -> 163.44.198.71:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.5:49715 -> 163.44.198.71:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: nffplp.com

Source: SOA Payment for June 30th.exe, 00000003.00000002.4597811398.000000000102F000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SOA Payment for June 30th.exe, 00000003.00000002.4597811398.0000000000F90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SOA Payment for June 30th.exe, 00000003.00000002.4602655404.00000000067B2000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597811398.000000000102F000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: SOA Payment for June 30th.exe, 00000003.00000002.4597811398.0000000001021000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597811398.000000000102F000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: SOA Payment for June 30th.exe, 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597811398.0000000001021000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002D81000.00000004.00000800.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nffplp.com
Source: SOA Payment for June 30th.exe, 00000003.00000002.4602655404.00000000067B2000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597811398.0000000001021000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597811398.000000000102F000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SOA Payment for June 30th.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: SOA Payment for June 30th.exe, 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: SOA Payment for June 30th.exe, 00000003.00000002.4597811398.0000000001021000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597811398.000000000102F000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, POq2Ux.cs	.Net Code: mDt2FXita0Y
Source: 0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack, POq2Ux.cs	.Net Code: mDt2FXita0Y

Installs a global keyboard hook

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\SOA Payment for June 30th.exe

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.SOA Payment for June 30th.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SOA Payment for June 30th.exe.4801698.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.SOA Payment for June 30th.exe.6f70000.8.raw.unpack, -Module-.cs	Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088
Source: 0.2.SOA Payment for June 30th.exe.2dcb678.3.raw.unpack, -Module-.cs	Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: SOA Payment for June 30th.exe

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_0133DDEC	0_2_0133DDEC
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_052F0006	0_2_052F0006
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_052F0040	0_2_052F0040
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_052FE8E0	0_2_052FE8E0
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058BD5D0	0_2_058BD5D0
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B6D50	0_2_058B6D50
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8B98	0_2_058B8B98
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058BD5C0	0_2_058BD5C0
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B75F8	0_2_058B75F8
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B6505	0_2_058B6505
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8487	0_2_058B8487
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B84D3	0_2_058B84D3
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058BC7B0	0_2_058BC7B0
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B87C3	0_2_058B87C3
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058BC7C0	0_2_058BC7C0
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B87F9	0_2_058B87F9
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8720	0_2_058B8720
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8762	0_2_058B8762
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B869E	0_2_058B869E
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B7608	0_2_058B7608
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8608	0_2_058B8608
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8638	0_2_058B8638
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B51E4	0_2_058B51E4
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8140	0_2_058B8140
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8150	0_2_058B8150
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8D2B	0_2_058B8D2B
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058BCD60	0_2_058BCD60
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058BCD70	0_2_058BCD70
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B6CE9	0_2_058B6CE9
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B5E0A	0_2_058B5E0A
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8994	0_2_058B8994
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B893F	0_2_058B893F
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B5940	0_2_058B5940
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B5950	0_2_058B5950
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B4888	0_2_058B4888
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B88B5	0_2_058B88B5
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8859	0_2_058B8859
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8850	0_2_058B8850
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8A9C	0_2_058B8A9C
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8A08	0_2_058B8A08
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8A74	0_2_058B8A74
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_070744D8	0_2_070744D8
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_070763F0	0_2_070763F0
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_07075FB8	0_2_07075FB8
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_0707BDB0	0_2_0707BDB0
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_07074900	0_2_07074900
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_07074910	0_2_07074910
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_07076828	0_2_07076828
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_02BB4AC0	3_2_02BB4AC0
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_02BBB929	3_2_02BBB929
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_02BB3EA8	3_2_02BB3EA8
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_02BBECC8	3_2_02BBECC8
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_02BB41F0	3_2_02BB41F0
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_02BBAD08	3_2_02BBAD08
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_069B9884	3_2_069B9884
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_06A1C280	3_2_06A1C280
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_06A15268	3_2_06A15268
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_06A1B31A	3_2_06A1B31A
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_06A13140	3_2_06A13140
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_06A17E68	3_2_06A17E68
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_06A17788	3_2_06A17788
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_06A1E4A8	3_2_06A1E4A8
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_06A10040	3_2_06A10040
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_06A159BB	3_2_06A159BB
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_070537D8	3_2_070537D8
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_06A10038	3_2_06A10038

Source: SOA Payment for June 30th.exe, 00000000.00000002.2152768594.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SOA Payment for June 30th.exe
Source: SOA Payment for June 30th.exe, 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename46da3e76-ea11-4ef3-9ed6-348209ad609f.exe4 vs SOA Payment for June 30th.exe
Source: SOA Payment for June 30th.exe, 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SOA Payment for June 30th.exe
Source: SOA Payment for June 30th.exe, 00000000.00000000.2142054703.000000000096C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedhSR.exeD vs SOA Payment for June 30th.exe
Source: SOA Payment for June 30th.exe, 00000000.00000002.2154408706.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename46da3e76-ea11-4ef3-9ed6-348209ad609f.exe4 vs SOA Payment for June 30th.exe
Source: SOA Payment for June 30th.exe, 00000000.00000002.2162363719.0000000006F70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs SOA Payment for June 30th.exe
Source: SOA Payment for June 30th.exe, 00000000.00000002.2163081890.000000000E820000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SOA Payment for June 30th.exe
Source: SOA Payment for June 30th.exe, 00000000.00000002.2154408706.0000000002D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs SOA Payment for June 30th.exe
Source: SOA Payment for June 30th.exe, 00000003.00000002.4597741905.0000000000F39000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SOA Payment for June 30th.exe
Source: SOA Payment for June 30th.exe, 00000003.00000002.4597596271.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename46da3e76-ea11-4ef3-9ed6-348209ad609f.exe4 vs SOA Payment for June 30th.exe
Source: SOA Payment for June 30th.exe	Binary or memory string: OriginalFilenamedhSR.exeD vs SOA Payment for June 30th.exe

Source: SOA Payment for June 30th.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.SOA Payment for June 30th.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SOA Payment for June 30th.exe.4801698.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SOA Payment for June 30th.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, ZTFEpdjP8zw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, WnRNxU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, 2njIk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, I5ElxL.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, QQSiOsa4hPS.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, FdHU4eb83Z7.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, PgU4rjWHipooK17TjE.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, PgU4rjWHipooK17TjE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, XNSlb6B08qHNUtpO6P.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, XNSlb6B08qHNUtpO6P.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, XNSlb6B08qHNUtpO6P.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, PgU4rjWHipooK17TjE.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, PgU4rjWHipooK17TjE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, XNSlb6B08qHNUtpO6P.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, XNSlb6B08qHNUtpO6P.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, XNSlb6B08qHNUtpO6P.cs	Security API names: _0020.AddAccessRule

Source: 0.2.SOA Payment for June 30th.exe.2d7710c.0.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SOA Payment for June 30th.exe.2e1496c.4.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SOA Payment for June 30th.exe.6ff0000.10.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/2

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SOA Payment for June 30th.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Mutant created: NULL

Source: SOA Payment for June 30th.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SOA Payment for June 30th.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SOA Payment for June 30th.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\SOA Payment for June 30th.exe "C:\Users\user\Desktop\SOA Payment for June 30th.exe"
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process created: C:\Users\user\Desktop\SOA Payment for June 30th.exe "C:\Users\user\Desktop\SOA Payment for June 30th.exe"
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process created: C:\Users\user\Desktop\SOA Payment for June 30th.exe "C:\Users\user\Desktop\SOA Payment for June 30th.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SOA Payment for June 30th.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SOA Payment for June 30th.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SOA Payment for June 30th.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: dhSR.pdbSHA256 source: SOA Payment for June 30th.exe
Source:	Binary string: dhSR.pdb source: SOA Payment for June 30th.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: SOA Payment for June 30th.exe, MainForm.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, XNSlb6B08qHNUtpO6P.cs	.Net Code: ltg2Lg3a4G System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA Payment for June 30th.exe.6f70000.8.raw.unpack, -Module-.cs	.Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA Payment for June 30th.exe.6f70000.8.raw.unpack, PingPong.cs	.Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, XNSlb6B08qHNUtpO6P.cs	.Net Code: ltg2Lg3a4G System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA Payment for June 30th.exe.2dcb678.3.raw.unpack, -Module-.cs	.Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.SOA Payment for June 30th.exe.2dcb678.3.raw.unpack, PingPong.cs	.Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])

Source: SOA Payment for June 30th.exe

Static PE information: 0xFDB78393 [Thu Nov 20 22:13:39 2104 UTC]

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_058B8359 push 8BBCEB50h; ret	0_2_058B835F
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_070794DF push ecx; ret	0_2_070794E0
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_070704E5 push edi; ret	0_2_070704E6
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_07078F85 push edi; ret	0_2_07078F8D
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_07073EE5 push ds; retn 6BA9h	0_2_07073EFF
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 0_2_0707D9DF push dword ptr [edx+ebp*2-75h]; iretd	0_2_0707D9EF
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Code function: 3_2_070511B0 push es; ret	3_2_070511C0

Source: SOA Payment for June 30th.exe

Static PE information: section name: .text entropy: 7.547057220379541

Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, YwLWgyXPBAopIKbCrb.cs	High entropy of concatenated method names: 'p1CjymAypU', 'bYSja073cG', 'rMpjtrsjbl', 'Hiht3ElZWG', 'TcGtz5t9ay', 'VW8jQfnytT', 'i4cjVBllS9', 'euRjC28ivK', 'W0Xj6P4hcQ', 'OGbj2txRvM'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, rKRWGqu92A81SjLtMH.cs	High entropy of concatenated method names: 'RbfpWe5iOC', 'Ke1pxb75TH', 'ACspPKllji', 'z3rpZ4Dhhr', 'NWMph6Y45l', 'ljHpEke7xd', 'blYpXdwvn6', 'exHpgbAL5b', 'B9Np1hjEnE', 'jjMp9wSWhY'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, n9wLcrbsxI69ytHYVi.cs	High entropy of concatenated method names: 'sulMYDhb7T', 'YfHM3Krrun', 'imWUQo8kbG', 'mMvUVbp9Us', 'j13M9H22XH', 'YZwMi4udDQ', 'LfAMudMEyZ', 'xmPM8veoMw', 'BGMM7J62D3', 'Gc5Mc5rmVw'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, mrA5CeP2jpv0OMJS3f.cs	High entropy of concatenated method names: 'AAntsEtvlR', 'TwEtO6mL9l', 'QMWtKWj6J5', 'HGTtjJydSw', 'sFetBnb7uS', 'qA2Kv8fuG3', 'JMdKbrKgUQ', 'UV4KrciJ0T', 'JRBKYohqVG', 'FyuKw8VWlE'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, Fsq0g0YA0jMpE3rSut.cs	High entropy of concatenated method names: 'Sf6UyaGKYw', 'iHcUOhXqaI', 'yMKUaKq6kf', 'PV0UK06Ods', 'ISTUtWEEbT', 'iaOUjf4XK8', 'FYiUBsyk1J', 'GNZUShKG6U', 'AOOUI4YESc', 'IOJU0HVtCy'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, SZrbkQzM8muv9CuKi5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ih9Gpml2C0', 'iFyGH2eZp3', 'hUuGD1NNxX', 'ihYGMXklaK', 'q9ZGUrxJgu', 'I7rGGawwAT', 'OZ2G5Hi7KZ'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, W5EcZlacMxmvZdcZ3f.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ytCCwu7XDq', 'giNC3Yfdlm', 'LfvCzBksSY', 'DsU6QgfFIS', 'gZB6VbctNC', 'RDS6CbYpS8', 'vB666iW3po', 'Os9QRft6CJNRVcAQHuk'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, Ewjs7PkGDxP0J1CSi9.cs	High entropy of concatenated method names: 'fPFjdEDI2v', 'ukxjn0XFUY', 'Q4rjLVvN5v', 'KwgjofCs2I', 'X0qjADvVFR', 'q7tjeEnaEb', 'DdHjfoe5iY', 'aPpjWFZNYo', 'M2vjxr4gDa', 'caKjTxbqn0'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, hUssHOchm4P0wyP4QI.cs	High entropy of concatenated method names: 'ToString', 'eyWD9oADua', 'pEODZE3ScG', 'Y3HDNqOrpo', 'S0iDhAI09j', 'kEKDEayftS', 'SvHDms980V', 'jLYDXTJwG7', 'DSNDgW6pnW', 'MxZDk6lYt7'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, CLuLMZxWyEmIQB6fb1.cs	High entropy of concatenated method names: 'N0Rao0AQgv', 'zR7aechmii', 'zkwaWlv784', 'HF1ax7fSw0', 's2ZaHjrVgq', 'QS1aDZxlxS', 'eLKaMnC7ZL', 'REBaUh8Zht', 's0caGaForx', 'wAUa5ITrn3'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, hLLm27O82It5qtK8OH.cs	High entropy of concatenated method names: 'Dispose', 'b0xVw58F8h', 'JAuCZDVFkI', 'MCeFFXJ8pa', 'APsV3q0g0A', 'mjMVzpE3rS', 'ProcessDialogKey', 'QtuCQBqHLW', 'lBQCVbwxrx', 'zU8CCGLPXR'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, G5L0jwCtfUw2t3wt08.cs	High entropy of concatenated method names: 'J0QLCLoBg', 'oVao1ZWsW', 'xggeuS1Jf', 'CD6fjmsGT', 'tLax7IDE0', 'NnRTtcgEy', 'qhsEGDe0dvTJNTM9cE', 'a4sNl04hhx0WHo9Nhn', 'USSUbJh3C', 'V0P5yrXRX'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, KPASsxV6qihCusmusuS.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Fnb58I4jRO', 'aIO579Xg9I', 'GO55c6iCN1', 'QPh54aXU1D', 'cd35vj1c6T', 'ey25bDNAKw', 'Ha95rRyYmq'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, PBqHLWwSBQbwxrxnU8.cs	High entropy of concatenated method names: 'Q7jUPQ9wc8', 'IPdUZN2Qh8', 'VPMUNa0I5e', 'SrWUhck10I', 'hnwU8AIATJ', 'opHUEMh12q', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, sLPXRI3dx5rsWTToAw.cs	High entropy of concatenated method names: 'M7VGVmnP3V', 'XslG6lxD2c', 'TG8G2Zr5XC', 'pPqGyV5PLv', 'qXeGOFXtM6', 'AbjGK0BmiI', 'Oi0Gt9dgaR', 'QT2Ur1wgnl', 'WB1UY2wHV7', 'JFgUwkFgtk'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, PP7L6b8iCrLnvpN05v.cs	High entropy of concatenated method names: 'fByH1f65pQ', 'MRUHilct0b', 'cUYH8YpoiV', 'bKTH730pkF', 'oPiHZvhyve', 'eSWHNE0DQm', 'WytHh8rGEK', 'vJjHE3GRnk', 'MvvHmv5GEU', 'qJBHXsFPFF'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, svnjfwTmZsLLWF8IvJ.cs	High entropy of concatenated method names: 'bepKARoegR', 'O1OKfhZU1s', 's3XaNvODs5', 'rleahhdRfp', 'iQ2aEKgI2Q', 'OXZamn94SV', 'a6QaXtsTfn', 'U0Cagu2eh8', 'aAGaks0a2C', 'NCAa1cJ4jY'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, n7hCtg2HEe17oOPfG3.cs	High entropy of concatenated method names: 'JjiVjgU4rj', 'oipVBooK17', 'GWyVIEmIQB', 'dfbV015vnj', 'w8IVHvJIrA', 'sCeVD2jpv0', 'yjDd1fFYxnyWo1yJQp', 'BjqKg5xtEfmy5QFqtl', 'EDmVV8j4vt', 'Y6tV67RR03'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, PgU4rjWHipooK17TjE.cs	High entropy of concatenated method names: 'JGWO862jMV', 'sgxO7pv3uM', 'f2jOcZqFZG', 'nMWO4aTHp5', 'h6NOvHybsn', 'zSKObcPb0u', 'idEOrRWBje', 'tBEOY4Wr6f', 'r6EOwZ8kli', 'fJHO3rQCmp'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, sLnj3yVQYhKYGc6N2e0.cs	High entropy of concatenated method names: 'cCYGdtkgrO', 'DV4GnM1U7X', 'eTiGLmfBPB', 'xM3Go8a2Lk', 'hoJGA0ioX5', 'OTEGenyBcJ', 'iplGfhmSYC', 'zmdGWxQY6h', 'EvCGxxRsfJ', 'JyKGTelYYQ'
Source: 0.2.SOA Payment for June 30th.exe.e820000.11.raw.unpack, XNSlb6B08qHNUtpO6P.cs	High entropy of concatenated method names: 'NLe6sdmjod', 'YIg6yG3UhQ', 'kWY6OrG7Xh', 'BQg6aqgegk', 'Aku6Ke4xTJ', 'Jgy6tlPDh5', 'biJ6jw1Jvg', 'gsR6BkYVw7', 'sCV6ShVl9X', 'SbF6I7WyMP'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, YwLWgyXPBAopIKbCrb.cs	High entropy of concatenated method names: 'p1CjymAypU', 'bYSja073cG', 'rMpjtrsjbl', 'Hiht3ElZWG', 'TcGtz5t9ay', 'VW8jQfnytT', 'i4cjVBllS9', 'euRjC28ivK', 'W0Xj6P4hcQ', 'OGbj2txRvM'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, rKRWGqu92A81SjLtMH.cs	High entropy of concatenated method names: 'RbfpWe5iOC', 'Ke1pxb75TH', 'ACspPKllji', 'z3rpZ4Dhhr', 'NWMph6Y45l', 'ljHpEke7xd', 'blYpXdwvn6', 'exHpgbAL5b', 'B9Np1hjEnE', 'jjMp9wSWhY'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, n9wLcrbsxI69ytHYVi.cs	High entropy of concatenated method names: 'sulMYDhb7T', 'YfHM3Krrun', 'imWUQo8kbG', 'mMvUVbp9Us', 'j13M9H22XH', 'YZwMi4udDQ', 'LfAMudMEyZ', 'xmPM8veoMw', 'BGMM7J62D3', 'Gc5Mc5rmVw'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, mrA5CeP2jpv0OMJS3f.cs	High entropy of concatenated method names: 'AAntsEtvlR', 'TwEtO6mL9l', 'QMWtKWj6J5', 'HGTtjJydSw', 'sFetBnb7uS', 'qA2Kv8fuG3', 'JMdKbrKgUQ', 'UV4KrciJ0T', 'JRBKYohqVG', 'FyuKw8VWlE'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, Fsq0g0YA0jMpE3rSut.cs	High entropy of concatenated method names: 'Sf6UyaGKYw', 'iHcUOhXqaI', 'yMKUaKq6kf', 'PV0UK06Ods', 'ISTUtWEEbT', 'iaOUjf4XK8', 'FYiUBsyk1J', 'GNZUShKG6U', 'AOOUI4YESc', 'IOJU0HVtCy'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, SZrbkQzM8muv9CuKi5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ih9Gpml2C0', 'iFyGH2eZp3', 'hUuGD1NNxX', 'ihYGMXklaK', 'q9ZGUrxJgu', 'I7rGGawwAT', 'OZ2G5Hi7KZ'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, W5EcZlacMxmvZdcZ3f.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ytCCwu7XDq', 'giNC3Yfdlm', 'LfvCzBksSY', 'DsU6QgfFIS', 'gZB6VbctNC', 'RDS6CbYpS8', 'vB666iW3po', 'Os9QRft6CJNRVcAQHuk'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, Ewjs7PkGDxP0J1CSi9.cs	High entropy of concatenated method names: 'fPFjdEDI2v', 'ukxjn0XFUY', 'Q4rjLVvN5v', 'KwgjofCs2I', 'X0qjADvVFR', 'q7tjeEnaEb', 'DdHjfoe5iY', 'aPpjWFZNYo', 'M2vjxr4gDa', 'caKjTxbqn0'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, hUssHOchm4P0wyP4QI.cs	High entropy of concatenated method names: 'ToString', 'eyWD9oADua', 'pEODZE3ScG', 'Y3HDNqOrpo', 'S0iDhAI09j', 'kEKDEayftS', 'SvHDms980V', 'jLYDXTJwG7', 'DSNDgW6pnW', 'MxZDk6lYt7'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, CLuLMZxWyEmIQB6fb1.cs	High entropy of concatenated method names: 'N0Rao0AQgv', 'zR7aechmii', 'zkwaWlv784', 'HF1ax7fSw0', 's2ZaHjrVgq', 'QS1aDZxlxS', 'eLKaMnC7ZL', 'REBaUh8Zht', 's0caGaForx', 'wAUa5ITrn3'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, hLLm27O82It5qtK8OH.cs	High entropy of concatenated method names: 'Dispose', 'b0xVw58F8h', 'JAuCZDVFkI', 'MCeFFXJ8pa', 'APsV3q0g0A', 'mjMVzpE3rS', 'ProcessDialogKey', 'QtuCQBqHLW', 'lBQCVbwxrx', 'zU8CCGLPXR'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, G5L0jwCtfUw2t3wt08.cs	High entropy of concatenated method names: 'J0QLCLoBg', 'oVao1ZWsW', 'xggeuS1Jf', 'CD6fjmsGT', 'tLax7IDE0', 'NnRTtcgEy', 'qhsEGDe0dvTJNTM9cE', 'a4sNl04hhx0WHo9Nhn', 'USSUbJh3C', 'V0P5yrXRX'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, KPASsxV6qihCusmusuS.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Fnb58I4jRO', 'aIO579Xg9I', 'GO55c6iCN1', 'QPh54aXU1D', 'cd35vj1c6T', 'ey25bDNAKw', 'Ha95rRyYmq'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, PBqHLWwSBQbwxrxnU8.cs	High entropy of concatenated method names: 'Q7jUPQ9wc8', 'IPdUZN2Qh8', 'VPMUNa0I5e', 'SrWUhck10I', 'hnwU8AIATJ', 'opHUEMh12q', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, sLPXRI3dx5rsWTToAw.cs	High entropy of concatenated method names: 'M7VGVmnP3V', 'XslG6lxD2c', 'TG8G2Zr5XC', 'pPqGyV5PLv', 'qXeGOFXtM6', 'AbjGK0BmiI', 'Oi0Gt9dgaR', 'QT2Ur1wgnl', 'WB1UY2wHV7', 'JFgUwkFgtk'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, PP7L6b8iCrLnvpN05v.cs	High entropy of concatenated method names: 'fByH1f65pQ', 'MRUHilct0b', 'cUYH8YpoiV', 'bKTH730pkF', 'oPiHZvhyve', 'eSWHNE0DQm', 'WytHh8rGEK', 'vJjHE3GRnk', 'MvvHmv5GEU', 'qJBHXsFPFF'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, svnjfwTmZsLLWF8IvJ.cs	High entropy of concatenated method names: 'bepKARoegR', 'O1OKfhZU1s', 's3XaNvODs5', 'rleahhdRfp', 'iQ2aEKgI2Q', 'OXZamn94SV', 'a6QaXtsTfn', 'U0Cagu2eh8', 'aAGaks0a2C', 'NCAa1cJ4jY'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, n7hCtg2HEe17oOPfG3.cs	High entropy of concatenated method names: 'JjiVjgU4rj', 'oipVBooK17', 'GWyVIEmIQB', 'dfbV015vnj', 'w8IVHvJIrA', 'sCeVD2jpv0', 'yjDd1fFYxnyWo1yJQp', 'BjqKg5xtEfmy5QFqtl', 'EDmVV8j4vt', 'Y6tV67RR03'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, PgU4rjWHipooK17TjE.cs	High entropy of concatenated method names: 'JGWO862jMV', 'sgxO7pv3uM', 'f2jOcZqFZG', 'nMWO4aTHp5', 'h6NOvHybsn', 'zSKObcPb0u', 'idEOrRWBje', 'tBEOY4Wr6f', 'r6EOwZ8kli', 'fJHO3rQCmp'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, sLnj3yVQYhKYGc6N2e0.cs	High entropy of concatenated method names: 'cCYGdtkgrO', 'DV4GnM1U7X', 'eTiGLmfBPB', 'xM3Go8a2Lk', 'hoJGA0ioX5', 'OTEGenyBcJ', 'iplGfhmSYC', 'zmdGWxQY6h', 'EvCGxxRsfJ', 'JyKGTelYYQ'
Source: 0.2.SOA Payment for June 30th.exe.49488f0.5.raw.unpack, XNSlb6B08qHNUtpO6P.cs	High entropy of concatenated method names: 'NLe6sdmjod', 'YIg6yG3UhQ', 'kWY6OrG7Xh', 'BQg6aqgegk', 'Aku6Ke4xTJ', 'Jgy6tlPDh5', 'biJ6jw1Jvg', 'gsR6BkYVw7', 'sCV6ShVl9X', 'SbF6I7WyMP'

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SOA Payment for June 30th.exe PID: 1576, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SOA Payment for June 30th.exe, 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: 1080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: 2D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: 2B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: 9080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: A080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: A290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: B290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: B6A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: C6A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: D6A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: E8A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: F8A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: 108A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: 118A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: 2D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Window / User API: threadDelayed 7157			Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Window / User API: threadDelayed 2667			Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 2696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 4208	Thread sleep count: 7157 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 4208	Thread sleep count: 2667 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -99532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -99407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -99282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -99172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -98588s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -98484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -98363s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -98235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -98110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -97985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -97860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -96235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -96110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -95860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -95735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -95610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -95485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -95360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -95235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -95110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -94985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -94860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -94735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -94610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -94485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -94360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -94235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -94110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe TID: 5528	Thread sleep time: -93985s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 98588	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 98363	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 95860	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 95610	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 95485	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 94985	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 94860	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 94735	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 94610	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 94485	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 94360	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 94235	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 94110	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Thread delayed: delay time: 93985	Jump to behavior

Source: SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: SOA Payment for June 30th.exe, 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: SOA Payment for June 30th.exe, 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: SOA Payment for June 30th.exe, 00000003.00000002.4597811398.000000000105F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Code function: 3_2_02BB70B0 CheckRemoteDebuggerPresent,

3_2_02BB70B0

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Memory written: C:\Users\user\Desktop\SOA Payment for June 30th.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Process created: C:\Users\user\Desktop\SOA Payment for June 30th.exe "C:\Users\user\Desktop\SOA Payment for June 30th.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Users\user\Desktop\SOA Payment for June 30th.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Users\user\Desktop\SOA Payment for June 30th.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.SOA Payment for June 30th.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.47c6078.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.4801698.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4599301189.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4599301189.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SOA Payment for June 30th.exe PID: 1576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SOA Payment for June 30th.exe PID: 6408, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SOA Payment for June 30th.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.SOA Payment for June 30th.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.47c6078.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.4801698.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4599301189.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SOA Payment for June 30th.exe PID: 1576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SOA Payment for June 30th.exe PID: 6408, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.SOA Payment for June 30th.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.47c6078.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.4801698.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.4801698.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SOA Payment for June 30th.exe.47c6078.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4599301189.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4599301189.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SOA Payment for June 30th.exe PID: 1576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SOA Payment for June 30th.exe PID: 6408, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	531 Security Software Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SOA Payment for June 30th.exe	32%	ReversingLabs	Win32.Trojan.Malgent
SOA Payment for June 30th.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://nffplp.com	0%	Avira URL Cloud	safe
http://tempuri.org/DataSet1.xsd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	true		unknown
nffplp.com	163.44.198.71	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nffplp.com	SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	SOA Payment for June 30th.exe, 00000003.00000002.4597811398.0000000001021000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597811398.000000000102F000.00000004.00000020.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002DE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	SOA Payment for June 30th.exe, 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp, SOA Payment for June 30th.exe, 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/DataSet1.xsd	SOA Payment for June 30th.exe	false	Avira URL Cloud: safe	unknown
http://ip-api.com	SOA Payment for June 30th.exe, 00000003.00000002.4599301189.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true
163.44.198.71	nffplp.com	Singapore		135161	GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467838
Start date and time:	2024-07-04 21:37:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SOA Payment for June 30th.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 180 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: SOA Payment for June 30th.exe

Simulations

Behavior and APIs

Time	Type	Description
15:38:07	API Interceptor	12645473x Sleep call for process: SOA Payment for June 30th.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	SecuriteInfo.com.Win32.MalwareX-gen.20684.5190.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	bL1WCnC18s.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	A1YOFV1abV.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	main.ps1	Get hash	malicious	Unknown	Browse	ip-api.com/json
	main.ps1	Get hash	malicious	Unknown	Browse	ip-api.com/json
	Orden.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	20240704-455.exe	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	McrflHf6vg.exe	Get hash	malicious	WhiteSnake Stealer	Browse	ip-api.com/line?fields=query,country
	Order List Pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	datos bancarios y c#U00f3digo swift incorrecto009.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
163.44.198.71	US00061Q0904081THBKK.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.17036.7156.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.25669.202.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Commercial_Inv_and_PList.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
nffplp.com	US00061Q0904081THBKK.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	SecuriteInfo.com.Win32.PWSX-gen.17036.7156.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	SecuriteInfo.com.Win32.PWSX-gen.25669.202.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	163.44.198.71
	Commercial_Inv_and_PList.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
ip-api.com	SecuriteInfo.com.Win32.MalwareX-gen.20684.5190.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	bL1WCnC18s.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	A1YOFV1abV.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	main.ps1	Get hash	malicious	Unknown	Browse	208.95.112.1
	main.ps1	Get hash	malicious	Unknown	Browse	208.95.112.1
	Orden.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	20240704-455.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	McrflHf6vg.exe	Get hash	malicious	WhiteSnake Stealer	Browse	208.95.112.1
	Order List Pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	datos bancarios y c#U00f3digo swift incorrecto009.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	US00061Q0904081THBKK.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	http://46814880-10-20181030130048.webstarterz.com/tedsplay.com/onlinebankingmtb/securityauthentication.html?onlinebanking.mtb.com/Login/MTBSignOn?security+authentication	Get hash	malicious	Unknown	Browse	163.44.198.51
	http://46814880-10-20181030130048.webstarterz.com/tedsplay.com/onlinebankingmtb/secq.html?onlinebanking.mtb.com/Login/MTBSignOn	Get hash	malicious	Unknown	Browse	163.44.198.51
	http://46814880-10-20181030130048.webstarterz.com/tedsplay.com/onlinebankingmtb/authenticate.html?onlinebanking.mtb.com/Login/MTBSignOn	Get hash	malicious	Unknown	Browse	163.44.198.51
	http://46814880-10-20181030130048.webstarterz.com/tedsplay.com/onlinebankingmtb/	Get hash	malicious	Unknown	Browse	163.44.198.51
	https://cpanel12wh.bkk1.cloud.z.com/~cp318430/app/browser/account.php	Get hash	malicious	HTMLPhisher	Browse	163.44.198.61
	Facture_160087511.html	Get hash	malicious	ScreenConnect Tool	Browse	163.44.198.43
	SecuriteInfo.com.Win32.PWSX-gen.17036.7156.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
	SecuriteInfo.com.Win32.PWSX-gen.25669.202.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	163.44.198.71
	Commercial_Inv_and_PList.exe	Get hash	malicious	AgentTesla	Browse	163.44.198.71
TUT-ASUS	SecuriteInfo.com.Win32.MalwareX-gen.20684.5190.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	bL1WCnC18s.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	A1YOFV1abV.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	main.ps1	Get hash	malicious	Unknown	Browse	208.95.112.1
	main.ps1	Get hash	malicious	Unknown	Browse	208.95.112.1
	Orden.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	20240704-455.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	McrflHf6vg.exe	Get hash	malicious	WhiteSnake Stealer	Browse	208.95.112.1
	Order List Pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	datos bancarios y c#U00f3digo swift incorrecto009.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\SOA Payment for June 30th.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.539501455291849
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SOA Payment for June 30th.exe
File size:	825'344 bytes
MD5:	63128eeca6e0dabeddfd68c0517d4c91
SHA1:	eb43eb41464d255d312b6b2aa14428ccd16156da
SHA256:	45d0c2ec2ede02e8b8ef535346a4e7e06fd52ba27995a15a5f1a0b11e305d4f7
SHA512:	73fabc52ee53b8ab3e70006c058ad6718b00cdc8259eccb7e545e7223d1cff7f84d670788484b6fdb59ef4930162d0ccbe83f2af4f1ab9fdc3d0577e9a767547
SSDEEP:	12288:dLYjofC1PHG1ub2dwZEWBMlQrpNO4904kZwB2JYoUev4y1VJznHhtbKOVDyTVoy:+1m1utZqi9gI0qB2JYofQOznHhhKGy
TLSH:	8C05F08532A88BC5EC694BF9F824D1F40360AC5A5C20D37B2DC1FECB3AB17615635A5B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4cadd2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFDB78393 [Thu Nov 20 22:13:39 2104 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcad7f	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcc000	0x5bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xce000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc8348	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc8dd8	0xc8e00	cbce5f7c1d4b8cfcb4aca8145cb4a3a0	False	0.8521069928438083	data	7.547057220379541	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xcc000	0x5bc	0x600	ee48b54efa6d37dd8787e6899992e0c0	False	0.4212239583333333	data	4.109832418641144	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xce000	0xc	0x200	c3cda794d8cef9429caa754c2f79663a	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xcc090	0x32c	data			0.42610837438423643
RT_MANIFEST	0xcc3cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 21:38:09.778100967 CEST	49713	80	192.168.2.5	208.95.112.1
Jul 4, 2024 21:38:09.786899090 CEST	80	49713	208.95.112.1	192.168.2.5
Jul 4, 2024 21:38:09.786956072 CEST	49713	80	192.168.2.5	208.95.112.1
Jul 4, 2024 21:38:09.787770033 CEST	49713	80	192.168.2.5	208.95.112.1
Jul 4, 2024 21:38:09.792618036 CEST	80	49713	208.95.112.1	192.168.2.5
Jul 4, 2024 21:38:10.282705069 CEST	80	49713	208.95.112.1	192.168.2.5
Jul 4, 2024 21:38:10.328507900 CEST	49713	80	192.168.2.5	208.95.112.1
Jul 4, 2024 21:38:12.241674900 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:12.246500969 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:12.249209881 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:13.947277069 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:13.947480917 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:13.952320099 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:14.291934967 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:14.292078018 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:14.296916008 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:14.638628006 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:14.643465996 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:14.648288965 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:15.002295017 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:15.002311945 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:15.002325058 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:15.002337933 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:15.002365112 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:15.002404928 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:15.096198082 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:15.140971899 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:15.141799927 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:15.146723032 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:15.487900972 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:15.501025915 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:15.506740093 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:15.845267057 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:15.847604990 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:15.852473021 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:16.192298889 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:16.192709923 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:16.197534084 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:16.562305927 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:16.563093901 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:16.567975044 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:16.907412052 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:16.907711983 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:16.912652016 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:17.330837965 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:17.331338882 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:17.336636066 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:17.676101923 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:17.677531004 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:17.677756071 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:17.677793026 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:17.677833080 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:17.682410955 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:17.682642937 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:17.682696104 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:17.682704926 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:18.272160053 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:38:18.312864065 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:38:59.777565002 CEST	80	49713	208.95.112.1	192.168.2.5
Jul 4, 2024 21:38:59.777698040 CEST	49713	80	192.168.2.5	208.95.112.1
Jul 4, 2024 21:39:01.094407082 CEST	49713	80	192.168.2.5	208.95.112.1
Jul 4, 2024 21:39:01.099343061 CEST	80	49713	208.95.112.1	192.168.2.5
Jul 4, 2024 21:39:51.110049009 CEST	49715	587	192.168.2.5	163.44.198.71
Jul 4, 2024 21:39:51.115127087 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:39:51.455573082 CEST	587	49715	163.44.198.71	192.168.2.5
Jul 4, 2024 21:39:51.460787058 CEST	49715	587	192.168.2.5	163.44.198.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 21:38:09.762804985 CEST	62241	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:38:09.772793055 CEST	53	62241	1.1.1.1	192.168.2.5
Jul 4, 2024 21:38:11.093286037 CEST	65001	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:38:12.094188929 CEST	65001	53	192.168.2.5	1.1.1.1
Jul 4, 2024 21:38:12.239953041 CEST	53	65001	1.1.1.1	192.168.2.5
Jul 4, 2024 21:38:12.243968964 CEST	53	65001	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 4, 2024 21:38:09.762804985 CEST	192.168.2.5	1.1.1.1	0xe583	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:38:11.093286037 CEST	192.168.2.5	1.1.1.1	0x209a	Standard query (0)	nffplp.com	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:38:12.094188929 CEST	192.168.2.5	1.1.1.1	0x209a	Standard query (0)	nffplp.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 4, 2024 21:38:09.772793055 CEST	1.1.1.1	192.168.2.5	0xe583	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:38:12.239953041 CEST	1.1.1.1	192.168.2.5	0x209a	No error (0)	nffplp.com	163.44.198.71	A (IP address)	IN (0x0001)	false
Jul 4, 2024 21:38:12.243968964 CEST	1.1.1.1	192.168.2.5	0x209a	No error (0)	nffplp.com	163.44.198.71	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	208.95.112.1	80	6408	C:\Users\user\Desktop\SOA Payment for June 30th.exe

Timestamp	Bytes transferred	Direction	Data
Jul 4, 2024 21:38:09.787770033 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 4, 2024 21:38:10.282705069 CEST	175	IN	HTTP/1.1 200 OK Date: Thu, 04 Jul 2024 19:38:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 4, 2024 21:38:13.947277069 CEST	587	49715	163.44.198.71	192.168.2.5	220-cpanel16wh.bkk1.cloud.z.com ESMTP Exim 4.96.2 #2 Fri, 05 Jul 2024 02:38:13 +0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 4, 2024 21:38:13.947480917 CEST	49715	587	192.168.2.5	163.44.198.71	EHLO 414408
Jul 4, 2024 21:38:14.291934967 CEST	587	49715	163.44.198.71	192.168.2.5	250-cpanel16wh.bkk1.cloud.z.com Hello 414408 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Jul 4, 2024 21:38:14.292078018 CEST	49715	587	192.168.2.5	163.44.198.71	STARTTLS
Jul 4, 2024 21:38:14.638628006 CEST	587	49715	163.44.198.71	192.168.2.5	220 TLS go ahead

Target ID:	0
Start time:	15:38:07
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\SOA Payment for June 30th.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SOA Payment for June 30th.exe"
Imagebase:	0x8a0000
File size:	825'344 bytes
MD5 hash:	63128EECA6E0DABEDDFD68C0517D4C91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2155363540.000000000473E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:38:08
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\SOA Payment for June 30th.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SOA Payment for June 30th.exe"
Imagebase:	0xab0000
File size:	825'344 bytes
MD5 hash:	63128EECA6E0DABEDDFD68C0517D4C91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4599301189.0000000002E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4599301189.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4599301189.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4597596271.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	361
Total number of Limit Nodes:	27

Executed Functions

Function 058B8B98 Relevance: 9.0, Strings: 7, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E8D
$cq, xrefs: 058B8E17
!Y3E, xrefs: 058B8C92
$cq, xrefs: 058B8E23

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: !Y3E$Tecq$Tecq$$cq$$cq$$cq$$cq
API String ID: 0-815790169
Opcode ID: f132a1c53dc34de5e53fe65234ecbbe07d40fb1de7d301241ca5174a2cd3d991
Instruction ID: 2c90a47b2712f992ec220eb870f62870ea0d108dd87ed70b0c9aaf257ab9c9ed
Opcode Fuzzy Hash: f132a1c53dc34de5e53fe65234ecbbe07d40fb1de7d301241ca5174a2cd3d991
Instruction Fuzzy Hash: FDA19374B102098FDB54DF78D954BAE7BEBBB88301F25842AE906DB394DEB4DC418B41

Function 058B869E Relevance: 5.4, Strings: 4, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 565058accfbe76148a242a4b2bbe7f29fedf3b7c6157e7d6c100257f1ce5706c
Instruction ID: 487c815ac7d5400dff085e74cbacd4241b5ef1d3c550605e9d8b5c457eb5a7c6
Opcode Fuzzy Hash: 565058accfbe76148a242a4b2bbe7f29fedf3b7c6157e7d6c100257f1ce5706c
Instruction Fuzzy Hash: 59D18175B00205CFE754CF68C895A9ABBFABB88301F15846AE905EB395CEB4DC41CF51

Function 058B84D3 Relevance: 5.3, Strings: 4, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 664263b4dd25f004e43720ae66d47245eff63f2f63f181b00e324a1f463aec21
Instruction ID: a344bf1ceb0ef3c42ad1d9137105247011662326cd2afc6630be336097b82d6a
Opcode Fuzzy Hash: 664263b4dd25f004e43720ae66d47245eff63f2f63f181b00e324a1f463aec21
Instruction Fuzzy Hash: 93D1A175B102048FE744CF68C895BAA7BFBBB88300F15846AE906EB395CEB4DC018F41

Function 058B8A08 Relevance: 5.3, Strings: 4, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 5b9873ca1f950704d1a92099fb0fa6b79b52d5d326a23a7a82e4a2d82714070f
Instruction ID: 26c25759c02efadd497b1ce38cf0c1746838f4016a9ccf042d41d714686ac4ef
Opcode Fuzzy Hash: 5b9873ca1f950704d1a92099fb0fa6b79b52d5d326a23a7a82e4a2d82714070f
Instruction Fuzzy Hash: 6DD19075B00205CFEB54CF68C895BAA7BFABB88301F15846AE905EB395DEB5DC018F41

Function 058B8859 Relevance: 5.3, Strings: 4, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 5b71832835c04e96898bebf742c79511bd57f7e93fa381c0f7da454a407d55f3
Instruction ID: 2f378b0bbed70f09c6b519605d965828cf7d727cb9edfd578ba4344c4edc2944
Opcode Fuzzy Hash: 5b71832835c04e96898bebf742c79511bd57f7e93fa381c0f7da454a407d55f3
Instruction Fuzzy Hash: F2D1A175B00205CFE744CF68C895BAA7BFABB88311F15846AE905EB395CEB49C41CF41

Function 058B8487 Relevance: 5.3, Strings: 4, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 34fde868f049e21501669d12c1c50683810c4fc5f7559aac045a4cdcba1c0a18
Instruction ID: 5a78dd113349a8683158ed2086481bf04e9639176dfade341fb2bc63b022881c
Opcode Fuzzy Hash: 34fde868f049e21501669d12c1c50683810c4fc5f7559aac045a4cdcba1c0a18
Instruction Fuzzy Hash: 34D1B375B101059FEB44CF68C895BAA7BFBBB88300F15846AE906EB395DEB4DC018F41

Function 058B87F9 Relevance: 5.3, Strings: 4, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 5949dd1e91c955307260d742c378daede7357a4c425fc3b03607737b7a9685b6
Instruction ID: c1e459bb4caa04050b9e3a2ddda61398f79f69e0a72f6ea57ae8576f6fd6c79a
Opcode Fuzzy Hash: 5949dd1e91c955307260d742c378daede7357a4c425fc3b03607737b7a9685b6
Instruction Fuzzy Hash: CCD1A275B002059FDB44CF68C895BAEBBBBBB88300F15446AE906EB395DEB49D41CF41

Function 058B8720 Relevance: 5.3, Strings: 4, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 1fb7c5dac06a5c8728b6e6536a6052b298371fdda56a8791d5ee66abf09721c0
Instruction ID: 44252f4d27d4a0ea729998fff220bfb1e26c9433b1a098e46b2ec44ff161d2f0
Opcode Fuzzy Hash: 1fb7c5dac06a5c8728b6e6536a6052b298371fdda56a8791d5ee66abf09721c0
Instruction Fuzzy Hash: 56C1A274B002059FEB44DF68C895BAE7BBBBB88300F15446AE906EB395CEB49D01CF41

Function 058B8A9C Relevance: 5.3, Strings: 4, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 6e706f40d6066619d7ff7cf9bb567a176b0f4e97071ddf66b73802a993dfd76e
Instruction ID: 800f5651d82819651a703b3dcc9f2ac273ffb8362fcdb893253ac84fecdcacdb
Opcode Fuzzy Hash: 6e706f40d6066619d7ff7cf9bb567a176b0f4e97071ddf66b73802a993dfd76e
Instruction Fuzzy Hash: FEC1A375B102058FEB54CF68C855BAA7BFBBB88301F15846AE906EB395DEB4DC018F41

Function 058B8850 Relevance: 5.3, Strings: 4, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 2d9fc8192cb6774506095ccb0d5d8b36ffd1089495014030c69e741e99cbb511
Instruction ID: 456137025e8998a48b70725acc6fe37d85d4183360bedf61028219aed03d039f
Opcode Fuzzy Hash: 2d9fc8192cb6774506095ccb0d5d8b36ffd1089495014030c69e741e99cbb511
Instruction Fuzzy Hash: 4FC1B275B102059FEB44CF78C895BAA7BFBBB88300F15446AE906EB395DEB49C018F41

Function 058B87C3 Relevance: 5.3, Strings: 4, Instructions: 330COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 926b005958bd3e452ebc2adf7b3b6a72a2787bd39b66c2af544049d9e4d17f1a
Instruction ID: 996d7aec2c9072e76143ede17a1bc150aaa2099a11ef3460625edf11f6123cd5
Opcode Fuzzy Hash: 926b005958bd3e452ebc2adf7b3b6a72a2787bd39b66c2af544049d9e4d17f1a
Instruction Fuzzy Hash: 40C1B375B002059FEB54DF68C895BAA7BFBBB88300F15446AE906EB395CEB4DC018F41

Function 058B8762 Relevance: 5.3, Strings: 4, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 4b3ee3388478f948fc0dcf1fb580b165c9d534548c07b45770e52ac3994b67c6
Instruction ID: 2523cb7e47feb66b816f23051d6fd6bb5433c822065ec65c2034f7f8abf3aa93
Opcode Fuzzy Hash: 4b3ee3388478f948fc0dcf1fb580b165c9d534548c07b45770e52ac3994b67c6
Instruction Fuzzy Hash: A2C1B475B002059FE744CF68C895BAA7BFBBB88300F15846AE906DB395DEB49C418F41

Function 058B8638 Relevance: 5.3, Strings: 4, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: e858f6b4557d263260ea5e9e578dd26ee80435b3b1faad8153b6f8f9ae8390c7
Instruction ID: 7426f12414ef1a960cfe941119269b256febec6409b9aebc19e8a35d7f81a63f
Opcode Fuzzy Hash: e858f6b4557d263260ea5e9e578dd26ee80435b3b1faad8153b6f8f9ae8390c7
Instruction Fuzzy Hash: 28C1B375B00205DFEB44CF68C895BAA7BFBBB88300F15446AE906EB395CEB49C418F41

Function 058B893F Relevance: 5.3, Strings: 4, Instructions: 330COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: a517d16bbaa58e1a2963ea14e92e876b91024c0784fc2114a07cc256bab4fb85
Instruction ID: 905b31e720e92fa52ee908a2af25c54f878dd335c419863f1dcb50bca2d16380
Opcode Fuzzy Hash: a517d16bbaa58e1a2963ea14e92e876b91024c0784fc2114a07cc256bab4fb85
Instruction Fuzzy Hash: F8C1A375B002059FEB44DF68C895BAEBBBBBB88300F15446AE906DB395DEB49C418F41

Function 058B88B5 Relevance: 5.3, Strings: 4, Instructions: 330COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 3feb3a1bb36c071f04486cecaea354599a5b2006989fa084d40ca7f995ffa149
Instruction ID: aca8a63e530104ca3fc1650239deeba92af9be520e183215aa8e46192f6f8abe
Opcode Fuzzy Hash: 3feb3a1bb36c071f04486cecaea354599a5b2006989fa084d40ca7f995ffa149
Instruction Fuzzy Hash: B4C1B375B10205CFEB54CF68C895BAA7BFBBB88300F15446AE906EB395DEB49C418F41

Function 058B8A74 Relevance: 5.3, Strings: 4, Instructions: 328COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 9b0943944bb5e5f39185b094c38aedb780cbc1f9da92f3cecdd228bc65379dac
Instruction ID: 6451c39e379c010af241e544f40737915d37dfabb3fae7cce6a11a74e22f3837
Opcode Fuzzy Hash: 9b0943944bb5e5f39185b094c38aedb780cbc1f9da92f3cecdd228bc65379dac
Instruction Fuzzy Hash: A1C1B374B002059FEB44CF68C895BAE7BFBBB88300F15446AE906EB395DEB49D418F41

Function 058B8994 Relevance: 5.3, Strings: 4, Instructions: 326COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: c89a3c38032a46e31b2ea9fc02f3df90d98bccaaea08ab7cf67fa5e8bd91e156
Instruction ID: fa58722d0af37358b4efc9267a6cc8d3b9b24e38a8486f44dbc287d1e5aaa28c
Opcode Fuzzy Hash: c89a3c38032a46e31b2ea9fc02f3df90d98bccaaea08ab7cf67fa5e8bd91e156
Instruction Fuzzy Hash: 58C1C175B002059FEB44CF68C895BAE7BBBBB88300F15446AE906EB395DEB49C418F41

Function 058B8608 Relevance: 5.3, Strings: 4, Instructions: 325COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058B8BC9
$cq, xrefs: 058B8E81
Tecq, xrefs: 058B8C0F
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq$$cq$$cq
API String ID: 0-3466483747
Opcode ID: 837e285bc2ed3cf7f391fd5ecc3fbde83112158d4c75667111f64b70826b7bcf
Instruction ID: 93f097389b19c4582d63db6eff56f695e33dbb85cfe79dfeb5dcfc55df9f8f4d
Opcode Fuzzy Hash: 837e285bc2ed3cf7f391fd5ecc3fbde83112158d4c75667111f64b70826b7bcf
Instruction Fuzzy Hash: C2C1A275B002059FEB44DF68C895BAE7BFBBB88300F15446AE906EB395DEB49C418F41

Function 058B8D2B Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$cq, xrefs: 058B8E81
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq
API String ID: 0-2695052418
Opcode ID: e5dda49c1bb16c446335eaa9903cf0c35c6aaf3707091d71abdbbc439f0b90e0
Instruction ID: 4c7d12fb5a90c9404f7fdb0679485eaef67ff002be08b07e2addf8cc5240ab4d
Opcode Fuzzy Hash: e5dda49c1bb16c446335eaa9903cf0c35c6aaf3707091d71abdbbc439f0b90e0
Instruction Fuzzy Hash: 5551A474B002099FEB14DF74D955BAE7BBBBB88300F248426E902EB390DEB59C418F41

Function 058BD5C0 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

T(z , xrefs: 058BD6BF

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: T(z
API String ID: 0-3184255237
Opcode ID: 3824661026ca81bcd0a5a6e77a26e676128b37b19181b5d91882365694643754
Instruction ID: e3fec7ac4497e5dd53b3413f5f138eafe690ef29416fe4d25ab9151a774e24b2
Opcode Fuzzy Hash: 3824661026ca81bcd0a5a6e77a26e676128b37b19181b5d91882365694643754
Instruction Fuzzy Hash: 56413171F052099BE718CAB589117EFB7BBABC9604F10C526D912EF394DAB08D018792

Function 058BD5D0 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

T(z , xrefs: 058BD6BF

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: T(z
API String ID: 0-3184255237
Opcode ID: 67c4205188a6e26538a0ad86ecc72db2e0a6d143e4fd10eda6e438ad1e93a76c
Instruction ID: 5765bf57d7fd88d17a14e8b39f24d7435987bf91a246d668568abf85c5618578
Opcode Fuzzy Hash: 67c4205188a6e26538a0ad86ecc72db2e0a6d143e4fd10eda6e438ad1e93a76c
Instruction Fuzzy Hash: 7D412D31F052099BE708CAB989517EFB7BBABC8604F10C526D912EF384DAB08D018796

Function 058B6505 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d88227a62e8dd1e0d9c8418ee28e2438dfb6a46eabea8307793dab4294edbee
Instruction ID: decb514b3fbfa9cee9982b4558f83aa868a7d0fe03480cd5cc0dcba9a778c149
Opcode Fuzzy Hash: 2d88227a62e8dd1e0d9c8418ee28e2438dfb6a46eabea8307793dab4294edbee
Instruction Fuzzy Hash: 49A1EC716142158FE704CF2AC9859A9BBBAFF81344B4A8496EC06DF392F7B1ED05CB41

Function 058B6CE9 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793e635eb6ed0e5553533efff85e2a37bb54c19f99718665b681f1bd6c203c24
Instruction ID: e0ab8f32990c3c0ed4bd377bef35658bb6b3624155257e9815dbd9ff95a31d41
Opcode Fuzzy Hash: 793e635eb6ed0e5553533efff85e2a37bb54c19f99718665b681f1bd6c203c24
Instruction Fuzzy Hash: EC71EC716241148FE704CF1AC9849B9BBBAFF81344B4684A6DC06EF3A2E7B1ED45CB41

Function 058B6D50 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f1ef981e114b6bbf36866a489e0eadf3c6e8d69c80e37389903ce410fc482d
Instruction ID: 6f502301eb40254cd3e2cb9b4b1e85e3e1368fbd18d6205b766649537ceaf00f
Opcode Fuzzy Hash: 69f1ef981e114b6bbf36866a489e0eadf3c6e8d69c80e37389903ce410fc482d
Instruction Fuzzy Hash: 3C61D171224115CFE704CF1AC9848B9BBBABF85344B568462EC06DF392E7B1ED45CB91

Function 0133D271 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0133D2FE
GetCurrentThread.KERNEL32 ref: 0133D33B
GetCurrentProcess.KERNEL32 ref: 0133D378
GetCurrentThreadId.KERNEL32 ref: 0133D3D1

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a7a33d946d825db3e20cd0b50639c4dd8729966d46e74bcdd647075c52496da7
Instruction ID: a6b2987ee4a0facf2d5daf5744282f47e9d002c82efb4b6c07a1b980fc7b7d02
Opcode Fuzzy Hash: a7a33d946d825db3e20cd0b50639c4dd8729966d46e74bcdd647075c52496da7
Instruction Fuzzy Hash: CE5134B0D0134A8FDB14DFAAD548BDEBBF5EB88314F208459E409A7360D7345988CB65

Function 0133D280 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0133D2FE
GetCurrentThread.KERNEL32 ref: 0133D33B
GetCurrentProcess.KERNEL32 ref: 0133D378
GetCurrentThreadId.KERNEL32 ref: 0133D3D1

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d89448ef71747a82b5a0f8c76297cf3e59d0adcfe1b0ed8a275edf0e145a60be
Instruction ID: ed0e8292d547a89f04d5bdd03a4620696ef9926abd7de2e54a11feafc96fd628
Opcode Fuzzy Hash: d89448ef71747a82b5a0f8c76297cf3e59d0adcfe1b0ed8a275edf0e145a60be
Instruction Fuzzy Hash: AC5135B0D0120A8FDB14DFAAD548BDEBBF5EF88314F208459E419A7360D7345988CB65

Function 058B8D89 Relevance: 2.6, Strings: 2, Instructions: 138COMMON

Download Yara Rule

Strings

$cq, xrefs: 058B8E81
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq
API String ID: 0-2695052418
Opcode ID: 5ce6d4c0a009c06b238fa156acc79da5077451c2da8c8e16f514532ef1e4b282
Instruction ID: 1178e80da7977bb084231c4edfe10fc209e160741552fcc72d8e956ee5981e78
Opcode Fuzzy Hash: 5ce6d4c0a009c06b238fa156acc79da5077451c2da8c8e16f514532ef1e4b282
Instruction Fuzzy Hash: 9A517278B002089FDB04DF75D955BAE7BB7BBC8701F248429E902EB394DEB59C018B51

Function 058B8DC3 Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

$cq, xrefs: 058B8E81
$cq, xrefs: 058B8E17

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq
API String ID: 0-2695052418
Opcode ID: 8ff3b75705f962f9532bfa368a19ed20852dfc091a5f81e8af905792ff0d5d2f
Instruction ID: b8e1879dc77ad73f5316aa6634f2983afba3badc743b76d9fa8a4e1b11e85630
Opcode Fuzzy Hash: 8ff3b75705f962f9532bfa368a19ed20852dfc091a5f81e8af905792ff0d5d2f
Instruction Fuzzy Hash: 7F419238B002089FD7049F74D955BAE7BA7BBC8700F248429E902EB390DEB59C018F51

Function 070778DF Relevance: 1.8, APIs: 1, Instructions: 266processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07077B56

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c1fd2e570ed2e5d74f674e9ee50f871f1d7fb4979a0339e381e8534034e3a7cd
Instruction ID: ea5cf51bba58117a4bd46482a50560a9c7b352a5642ad4543382b3e9c8aa8f1b
Opcode Fuzzy Hash: c1fd2e570ed2e5d74f674e9ee50f871f1d7fb4979a0339e381e8534034e3a7cd
Instruction Fuzzy Hash: A4A18EB1D0025A9FDB20CF68C8417DDBBF2BF49354F1482AAD848A7240DB749A85CF96

Function 07077920 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07077B56

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e2f19af95c1d45debf9efe463f18ae1d39ecb6d3b6c7fe82d95bbee6f27f24c6
Instruction ID: 086e04dcb9893a8faf2ed0f2b94a9110fd8c3759d7db9063084c0091cee1f561
Opcode Fuzzy Hash: e2f19af95c1d45debf9efe463f18ae1d39ecb6d3b6c7fe82d95bbee6f27f24c6
Instruction Fuzzy Hash: 309150B1D0025ADFEB24CF68C841BDDBBF2BF48354F1486A9D808A7240DB749985CF96

Function 0133AFE8 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0133B23E

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9f700b8c575779ac4461fa4c82591c82629a9a4bdff8895ea3f63cc22396cd48
Instruction ID: 393d9e1da8e9331bc961e1ace6aa326e950414c0271f80988584f89c7026bcd0
Opcode Fuzzy Hash: 9f700b8c575779ac4461fa4c82591c82629a9a4bdff8895ea3f63cc22396cd48
Instruction Fuzzy Hash: 1A712170A00B058FDB24DF29D44475AFBF1BF88208F108A2AD49ADBA44D775E949CB94

Function 052F1CE4 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 052F1E02

Memory Dump Source

Source File: 00000000.00000002.2161036198.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52f0000_SOA Payment for June 30th.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 790943df293893bd43e813e9d533ebfa2fed2962a8ad4d062a74b17d4c4c0db1
Instruction ID: 5732bb462ea7c7c1e77b63f693925a19482af30c376098624e012dbc73614cd7
Opcode Fuzzy Hash: 790943df293893bd43e813e9d533ebfa2fed2962a8ad4d062a74b17d4c4c0db1
Instruction Fuzzy Hash: D751DFB1D10249DFDB14CFA9D884ADEFBB5BF88310F64822AE919AB210D7709845CF90

Function 052F1CF0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 052F1E02

Memory Dump Source

Source File: 00000000.00000002.2161036198.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52f0000_SOA Payment for June 30th.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a2293e0c2f8a4925914fcc1e2de16591a71727866701e23b87d2edc93fc1806b
Instruction ID: fb7ef97615d753cb85f04b367b9a601ef74bbfac6e92a141654ba6ab07d33daa
Opcode Fuzzy Hash: a2293e0c2f8a4925914fcc1e2de16591a71727866701e23b87d2edc93fc1806b
Instruction Fuzzy Hash: 7841BDB1D10309DFDB14CF99D984ADEFBB6BF48310F64812AE919AB210D7719945CF90

Function 052F1284 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 052F4381

Memory Dump Source

Source File: 00000000.00000002.2161036198.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52f0000_SOA Payment for June 30th.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 71b2b8b66fcb7c4e2a50f7d8504775f39b3077728e607955fbe6432ab8d3556f
Instruction ID: 95c8dd9af1a48f87cd4838e98bb2153ad60b1716abc0b0e5487b016bdcee6720
Opcode Fuzzy Hash: 71b2b8b66fcb7c4e2a50f7d8504775f39b3077728e607955fbe6432ab8d3556f
Instruction Fuzzy Hash: 2E4128B59102058FCB18DF99D448AABFBF5FF88314F258859D519AB321D374A845CBA0

Function 01334514 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 013359C9

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 575352928f47dafa39efca824b220a8b53b7bb1271892786f9ba6d2b2abe1cb3
Instruction ID: 9a4e1f34f9c338173bf35cf16bb5b68aa6601903982829df81b93648608c2406
Opcode Fuzzy Hash: 575352928f47dafa39efca824b220a8b53b7bb1271892786f9ba6d2b2abe1cb3
Instruction Fuzzy Hash: A441C5B0C0071DCBDB25DFA9C984B9EBBF5BF89308F208059D409AB251DB756949CF91

Function 0133590C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 013359C9

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: eeefb67cc94749dd85d91037d825a64797f5fd05758d67d9b9aa9697ed12005c
Instruction ID: c6d1f4f44a6641b0e7de7491d5b7d937d989f5fd5aca4b3621f8c04142642513
Opcode Fuzzy Hash: eeefb67cc94749dd85d91037d825a64797f5fd05758d67d9b9aa9697ed12005c
Instruction Fuzzy Hash: 4641F4B0C00719CBEB25CFA9C884BCEBBF5BF85304F208059D409AB251DB75694ACF91

Function 01335A84 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c3cdb9d4f55757ba1cf4e699485637f7d095cfff7784f7a0d97b3dd2094c25
Instruction ID: 5be7bd11e5246062d0dd0cb0e8c2197b2b936065ab5d1d98a328598be0e16818
Opcode Fuzzy Hash: a0c3cdb9d4f55757ba1cf4e699485637f7d095cfff7784f7a0d97b3dd2094c25
Instruction Fuzzy Hash: 8231E872C09349CFEB12CBA8C8553DDBFB1AF92319F24808AC4459B252C735594ACF45

Function 07077290 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07077328

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 990bc309c557a51b53f70421b88fbece5f7c62ece80c2d8e787b4448a445fbbc
Instruction ID: ecd5163128102303057bdd8104922d60c39cd041112b75ff96d430f956d0621d
Opcode Fuzzy Hash: 990bc309c557a51b53f70421b88fbece5f7c62ece80c2d8e787b4448a445fbbc
Instruction Fuzzy Hash: FB2124B2D002499FCB10CFA9C885BDEBBF5FF48310F10842AE919A7240D7789945CBA5

Function 07077298 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07077328

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7a57175b68f2427ca7c67193170ab8bc638bac6ec890323cf2ab1f9b68fc5731
Instruction ID: 6ea026a4b8806a8b176f3d37d359f2150efae5607d457253cca99c95326087b4
Opcode Fuzzy Hash: 7a57175b68f2427ca7c67193170ab8bc638bac6ec890323cf2ab1f9b68fc5731
Instruction Fuzzy Hash: 572125B2D003499FCB10CFA9C885BDEBBF5FF88314F10842AE919A7240D7789945CBA5

Function 07077381 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07077408

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c6895b50617a1a9382d0713510d09347abccdb396f4cb9615e27eeacada22349
Instruction ID: ec8e9cede2ed41717f65af82b6fe05cc40bfad8e52a4949b57e8778aac1bb18e
Opcode Fuzzy Hash: c6895b50617a1a9382d0713510d09347abccdb396f4cb9615e27eeacada22349
Instruction Fuzzy Hash: BF2136B2D003599FCB10DFAAC845ADEBFF5FF88310F10882AE519A7240D7749945CBA5

Function 070770F8 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0707717E

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0240cdedfa14ddf78f9e7d8af600c2ff6f8bb2ba396c27cbe7d09f0c2ff018fc
Instruction ID: ba9612de35a3a9d6753a75963e6de33dcea7106b174c62f87d2a84ec70ed3604
Opcode Fuzzy Hash: 0240cdedfa14ddf78f9e7d8af600c2ff6f8bb2ba396c27cbe7d09f0c2ff018fc
Instruction Fuzzy Hash: 752128B1D002099FDB14DFAAC8857EEBBF4AF88324F148429D559A7340CB789945CFA5

Function 0133D4C1 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0133D54F

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 017f02c08198d4a67bb50b9e8fdcb3d99db3aee88bd761a2dfca5648381fc887
Instruction ID: a4fdc3ea93ae1f6aa97be16b188350e72789d36d7c149ebc0f4b438addb7f059
Opcode Fuzzy Hash: 017f02c08198d4a67bb50b9e8fdcb3d99db3aee88bd761a2dfca5648381fc887
Instruction Fuzzy Hash: 9621E3B5D002099FDB10CF9AD484ADEBFF8FB48314F14841AE918A3350D374A944CF65

Function 07077388 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07077408

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 081b814ac8363449854514c5b5b00846983869a1e1d4621024f33fe63ce38abe
Instruction ID: 6029958dd4b68f1293c164f102defe7ebf6d2318b3a3df0359d132918d0b6910
Opcode Fuzzy Hash: 081b814ac8363449854514c5b5b00846983869a1e1d4621024f33fe63ce38abe
Instruction Fuzzy Hash: 7F2116B1D002599FCB10DFAAC845ADEBBF5FF48310F508429E519A7240C7749945DBA5

Function 07077100 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0707717E

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6b56f45089f6f2f665cb8b9a01a1d3db1d9afef0291744c52f71ec4e6d0df697
Instruction ID: e552330f5919b4a87c766f076e05dd602d868373cbe4b9f53eedd48b9526e12f
Opcode Fuzzy Hash: 6b56f45089f6f2f665cb8b9a01a1d3db1d9afef0291744c52f71ec4e6d0df697
Instruction Fuzzy Hash: F72134B1D003098FDB10DFAAC4857AEBBF4AB88324F10842AD519A7340CB78A945CFA5

Function 0133D4C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0133D54F

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cca77ea3d68bd52c242e833a31e6280c06bb10761385433bca454e534ca5e313
Instruction ID: ecb5051b0a479ef8ae3535ebd2cdfedecbbf2f29b057acf2d472807ac4d8d0cd
Opcode Fuzzy Hash: cca77ea3d68bd52c242e833a31e6280c06bb10761385433bca454e534ca5e313
Instruction Fuzzy Hash: A921C2B5D002499FDB10CFAAD984ADEBFF9FB48314F14841AE918A3350D374A954CFA5

Function 070771D0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07077246

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f9805b02a9f550f722454976a686ed73e74238cdf1f1743479a0ab2b4c52a646
Instruction ID: 9ca772e5db4329dbe47401d832061020a1e969f92625cd477f5f0b3a7c515b3a
Opcode Fuzzy Hash: f9805b02a9f550f722454976a686ed73e74238cdf1f1743479a0ab2b4c52a646
Instruction Fuzzy Hash: AC116AB6C002499FCB10DFA9C845ADFBFF5EF88320F108819E529A7250C7359945CFA1

Function 0133AD08 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0133B2B9,00000800,00000000,00000000), ref: 0133B4CA

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 53f7867281a43c73b6c9e8432c448c64e88bebcd282aa0c47257639c60e78499
Instruction ID: 8ae39487ed115a32bd8ccdbaf1dc30bacf7107b10bfa7409e7fea781d3a0bc32
Opcode Fuzzy Hash: 53f7867281a43c73b6c9e8432c448c64e88bebcd282aa0c47257639c60e78499
Instruction Fuzzy Hash: C31103B6D003099FDB10CF9AC444A9EFBF8EB88314F10842AE519B7700C375A945CFA9

Function 0133B458 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0133B2B9,00000800,00000000,00000000), ref: 0133B4CA

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 93e9bd2b18bc2a6d3f138f93ca2e90affccc1e7bc1fc7bf2f8a5986ade1819a4
Instruction ID: aeccc9a97e84bf90916f51b712e492f9792a7785fcd55c81f5fe40a60524db1a
Opcode Fuzzy Hash: 93e9bd2b18bc2a6d3f138f93ca2e90affccc1e7bc1fc7bf2f8a5986ade1819a4
Instruction Fuzzy Hash: A01114B6C002498FDB20CFAAD445ADEFFF4EB88314F10842AD959B7600C375A945CFA5

Function 070771D8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07077246

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b9474d815590f6f55da91cf5500bd754c1750ff71bdfaf443e550984d9762c0a
Instruction ID: d7a942dd04bcccf0cedd195db012542730f912968cdaa9ba2a2dccfeda4af3e4
Opcode Fuzzy Hash: b9474d815590f6f55da91cf5500bd754c1750ff71bdfaf443e550984d9762c0a
Instruction Fuzzy Hash: AD1137B2D002499FCB10DFAAC845ADFBFF5EF88324F108819E519A7250C775A955CFA1

Function 0707704A Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 070770B2

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 855d1d7f2e51d7858ce8427d9f63e613593f77a8c793175074f4275ab91478c2
Instruction ID: 13d31927d7cf9f2de42eb5f51c4c51a7494d453a8a76c343381967cddf32e4dc
Opcode Fuzzy Hash: 855d1d7f2e51d7858ce8427d9f63e613593f77a8c793175074f4275ab91478c2
Instruction Fuzzy Hash: 521128B1D002498BCB20DFAAC8457DEFFF4AF88325F248419D519A7340CB75A944CBA5

Function 0707BC1C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,0707C911,?,?), ref: 0707CAB8

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 12d59908c0ace5ebf19f2745b040401fabf85bef63d4a724e944bb11d2d00514
Instruction ID: f86d9a844e949074287e80ba476058df59dce86debf151bdc91148899800c1b9
Opcode Fuzzy Hash: 12d59908c0ace5ebf19f2745b040401fabf85bef63d4a724e944bb11d2d00514
Instruction Fuzzy Hash: 3A1125B5C003499FDB10DF99C449BEEBBF8EB48324F14885AE559A7340D338A944CFA5

Function 0707BC64 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,0707C911,?,?), ref: 0707CAB8

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e9e01bf0d69c36499dd66aaa030c2758f80e84f69177a5e8f4553648caf62c1b
Instruction ID: e1e37116d8fda978f706d5ec91496e59f2cc45a262264d2046da3897871ccdf0
Opcode Fuzzy Hash: e9e01bf0d69c36499dd66aaa030c2758f80e84f69177a5e8f4553648caf62c1b
Instruction Fuzzy Hash: 4F1136B5C003499FDB10DF99C449BDEBBF8EB48324F14885AE559A7340D338A944CFA5

Function 0707BB7C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,0707C911,?,?), ref: 0707CAB8

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c94de4bad08d2c9c2cc125573f8c8b80a5feec482f97fe09dda8ecd230c14e2b
Instruction ID: c560f4c3ec132bc145410b320f66f3f4a3e607e49ebb26aec0f06727f8893d50
Opcode Fuzzy Hash: c94de4bad08d2c9c2cc125573f8c8b80a5feec482f97fe09dda8ecd230c14e2b
Instruction Fuzzy Hash: 4E1136B5C003499FDB10DF9AC449BDEBBF8EB48324F14886AD559A7340D338A944CFA5

Function 07077050 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 070770B2

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b5959c86edff07935cc90f6322c90e3d956fd6448395c33d95610ec8ddbc0ef0
Instruction ID: a4e4ec4f3ea12c68f924609aa78f70fc01c06d842e874e864ffbdafc291383ed
Opcode Fuzzy Hash: b5959c86edff07935cc90f6322c90e3d956fd6448395c33d95610ec8ddbc0ef0
Instruction Fuzzy Hash: 911125B1D002498BCB20DFAAC8497DEFFF4AB88324F208819D519A7240CB75A944CBA5

Function 0707CA58 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,0707C911,?,?), ref: 0707CAB8

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9201f47af2537a077e390d81d69e3caee58351b943911e76189c6d8794d8cc68
Instruction ID: 68fa0e94ccb69b0ce3b1ca459d1351a3d1257e4e7c27e14c83d4296570afebc7
Opcode Fuzzy Hash: 9201f47af2537a077e390d81d69e3caee58351b943911e76189c6d8794d8cc68
Instruction Fuzzy Hash: 331136B5C002499FDB10DF99D445BEEBBF5EB48320F24881AD558A7740C338A944CFA5

Function 07077534 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07079E85

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9d5c97531d366e5a6a9f548c932dbde126ee9e44cf2b9c559528ba3c79233240
Instruction ID: aacb17dee42461d9d22b94a1e95931818e3026eeded83f95dcbc37bd631d5db2
Opcode Fuzzy Hash: 9d5c97531d366e5a6a9f548c932dbde126ee9e44cf2b9c559528ba3c79233240
Instruction Fuzzy Hash: DD11E0B5C143499FCB10DF9AC449BDEBBF8EB48324F108859E558A7300C375A944CFA5

Function 07079E20 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07079E85

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 221d561979b5ac20903ed8893df82ffb5667909312018d12b54b84c90983b11a
Instruction ID: c699af29f31aee6b849e633de46dcb133bd4c61a0a238dbb756341345818a3e8
Opcode Fuzzy Hash: 221d561979b5ac20903ed8893df82ffb5667909312018d12b54b84c90983b11a
Instruction Fuzzy Hash: 2211E0B5C003499FCB10CF9AD849BDEBBF8EB48324F148419E558A7610C375A984CFA5

Function 0133B1D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0133B23E

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: aed641ffbb5702d8f449d361d39bd3d082fe3d73646e88801b20d17e45e1ea3e
Instruction ID: cda93eee93f1c2d087d211d562ab8f88fba9ea426b1bb2d42d9709aae95a21af
Opcode Fuzzy Hash: aed641ffbb5702d8f449d361d39bd3d082fe3d73646e88801b20d17e45e1ea3e
Instruction Fuzzy Hash: 361122B6C003498FDB10CF9AD444ADEFBF4EF88314F10851AD529A7600C375A549CFA5

Function 0133B500 Relevance: 1.5, APIs: 1, Instructions: 44libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0133B2B9,00000800,00000000,00000000), ref: 0133B4CA

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 78dd8cae57a9ef05fc6415c0bbbaf89c580ff11740b972bfc3efcef735f24a2b
Instruction ID: c70a6863523c80fe457b293f30c02ffce1f2c5107d326fd814454cc50c0cbbbb
Opcode Fuzzy Hash: 78dd8cae57a9ef05fc6415c0bbbaf89c580ff11740b972bfc3efcef735f24a2b
Instruction Fuzzy Hash: 6101DFB28043448FDB208BADE4097EAFFF4AF95329F14805AD558E7611C3799815CBA9

Function 058B50F4 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058BBD99

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq
API String ID: 0-1122318316
Opcode ID: 8cce4d4125f074fc741a831a0391af9928f165b65f4931996de90b3810a7cd61
Instruction ID: 657e3b21cd3d9abdd9fde3194844b1887866a0510b27feaf493257efc7bd8b70
Opcode Fuzzy Hash: 8cce4d4125f074fc741a831a0391af9928f165b65f4931996de90b3810a7cd61
Instruction Fuzzy Hash: 1851C030B0021A4FCB11DB7988549BEBBFAFFC5320B148969E455CB391EF749D058790

Function 058BB750 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058BB7BB

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq
API String ID: 0-1122318316
Opcode ID: a6653dcfd7260577a0de755c89e0ddf425809a79849be306e9cd50d6d8eb31d5
Instruction ID: 8dff7cc4aa22b92848130a8e45528cc0d88045461dea3de3525711c8d00cfeed
Opcode Fuzzy Hash: a6653dcfd7260577a0de755c89e0ddf425809a79849be306e9cd50d6d8eb31d5
Instruction Fuzzy Hash: 3A112171F0020A8BDB14EBB999515EFB7FABBC4351B544079C909E7354EB718D01CBA1

Function 058BB281 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

", xrefs: 058BB288

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: a8d0d5279693c907dd0b0ef24ae3d54cf7fdd3a3a582a23473dd4142cdb21710
Instruction ID: 4d28547469517ffccb4ca4507d6008a147e569e25950f788b749cd02cb27f8dc
Opcode Fuzzy Hash: a8d0d5279693c907dd0b0ef24ae3d54cf7fdd3a3a582a23473dd4142cdb21710
Instruction Fuzzy Hash: 93F0B4357042505FCB1156B9A4298AA3BEB9BC662131541A7ED09CF361DDB08C068791

Function 058B9ACF Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a09bb0795595678962bcaaa68052e0686d9aa89ea99d3f5d4aa21bfb35ab67c
Instruction ID: fb2f39a2e78b73eeb96831bc1da1a91467c164e5e44c39b64b3c9722a617c06b
Opcode Fuzzy Hash: 2a09bb0795595678962bcaaa68052e0686d9aa89ea99d3f5d4aa21bfb35ab67c
Instruction Fuzzy Hash: A0519D74909688DFD706CBAAE554988BFB1AF4A200F2A80C6D984DF263CB749D15CB13

Function 058B9C80 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff47a4edd23f233aa67c308ad8fd098687ade200bc3282ad8539bfbccdd7670
Instruction ID: fbdffcc2057dc1a2d8635f36f73f8ff4a85a7e1b3b1557cbcc04036ad4b1748a
Opcode Fuzzy Hash: fff47a4edd23f233aa67c308ad8fd098687ade200bc3282ad8539bfbccdd7670
Instruction Fuzzy Hash: 1E41067490921DDFDB00CFAAE4848FEBBBAFB0E214F455855EA56E7311D7B09820CB61

Function 058B9C90 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c727c6148ab0fb4dd5bfed2db546589ef2dbe020b3102efceec37413274151d1
Instruction ID: b5f8497d4f7203464dd52367f8c06c9d48cf7e7434e6c6819c3d38386cc9fc9c
Opcode Fuzzy Hash: c727c6148ab0fb4dd5bfed2db546589ef2dbe020b3102efceec37413274151d1
Instruction Fuzzy Hash: 2941F77490921DDFDB00CFAAE4848FEBBBAFB4E204F455855EA16E7311D7B09810CB60

Function 058BA553 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a49b3ced3edc636ee683bbd4aa25a5b40c4fa57bb2909516c1faf8f0fe58827
Instruction ID: a2c1ffd6004fb40932146ffd8a4e1fa3787fafede748c0c429fa73a36dbaa4b5
Opcode Fuzzy Hash: 1a49b3ced3edc636ee683bbd4aa25a5b40c4fa57bb2909516c1faf8f0fe58827
Instruction Fuzzy Hash: F94189B4E0021D9FDB09DFA9D884AEEBBB6BB0A200F509015E816FB310DB749E41CF14

Function 058BBB14 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7f113403a743ea3dfc8ed4ee65869251ecd446368e11a775faa8e3309b6fe1
Instruction ID: 3467b02911eb2f555d78572574ffdbe0147fb332e64a426d33e2c08de657ed54
Opcode Fuzzy Hash: 1d7f113403a743ea3dfc8ed4ee65869251ecd446368e11a775faa8e3309b6fe1
Instruction Fuzzy Hash: BD3166B6904249AFDB10DFA9D844ADEBFF9EF49310F10846AE909E7310D770A945CFA1

Function 0102D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152993211.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_102d000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c5b5b10a82490b923e7b020d6d3ebb4ee435c2cbff3b78e663425b9f3797e0
Instruction ID: 6f0db9d0825e3c902c301f755a0573a3b2321454a8f521e6a82e023cb9e3ff17
Opcode Fuzzy Hash: 18c5b5b10a82490b923e7b020d6d3ebb4ee435c2cbff3b78e663425b9f3797e0
Instruction Fuzzy Hash: 65210AB1504240DFDF05DF98D9C4B2ABFA5FB99324F24C5A9ED490B246C336D81ACBA1

Function 0102D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152993211.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_102d000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bad2deaf560a569a22f4b318ef6ea9e60f2a348cedef80b5b3f704007b3d28b
Instruction ID: f183a29e2a83b92f62cc4965f4b1f3a49c4de6bf68389c86bcb47e63093c7047
Opcode Fuzzy Hash: 0bad2deaf560a569a22f4b318ef6ea9e60f2a348cedef80b5b3f704007b3d28b
Instruction Fuzzy Hash: F82167B1504250DFDB01DF58D9C0B2ABFA5FB88318F34C5ADE8890B246C376D856CBA1

Function 058BBDDC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721942054d138cc5835b9c5b75aa83f151b5412ad9136e97424131f0dfa82091
Instruction ID: 9b809923893f9f2e2c0cbdcc4b0a5389e5274c61a3e6df81be61c25c6776db02
Opcode Fuzzy Hash: 721942054d138cc5835b9c5b75aa83f151b5412ad9136e97424131f0dfa82091
Instruction Fuzzy Hash: 5F31C0B5C012189FDB20CFA9D989BCEBFF5BB48314F14805AE944AB350C7B55885CBA1

Function 058BBAAC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b60585d20fcec2793df683f137133c55492bc170918c5eef179d2f8f7f13e7b
Instruction ID: fe6888a5daf33a9f84686a29fbed5d35f0185de718f8f36c4b143b08d9aee976
Opcode Fuzzy Hash: 4b60585d20fcec2793df683f137133c55492bc170918c5eef179d2f8f7f13e7b
Instruction Fuzzy Hash: 8421A564A093C56FDB06DB7888158A93FB99B0720071648DBE844C7253E9749D09C761

Function 0103D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153018465.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_103d000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45fcb7e50dc39491aaab6897fcac31a78831a02cd507c675a6ecba1ebe54f036
Instruction ID: f332b24ec109ecfe18608ea72b59b47b45950563ed104484b4725a4c181f119c
Opcode Fuzzy Hash: 45fcb7e50dc39491aaab6897fcac31a78831a02cd507c675a6ecba1ebe54f036
Instruction Fuzzy Hash: 7D2168B1504200EFDB01DF98D9C0B2ABBA9FBD4324F64C9ADE8894B342C336D406CB61

Function 0103D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153018465.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_103d000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ead9a942e047bcfb35e6ffe8b14f510229745b088994c89faf89cbae4519df
Instruction ID: b1fa3f978c6f335080438e9265c7e2c31e49e8ed48d3ba7c2f74f00ad2c7633b
Opcode Fuzzy Hash: d6ead9a942e047bcfb35e6ffe8b14f510229745b088994c89faf89cbae4519df
Instruction Fuzzy Hash: F22103B1504200DFDB15DF98D5C0B16FBA9EBC4714F64C5ADE98A0B246C336D407CB61

Function 058BB954 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374651680ad5ff2d98021a8d98523d7e777448e2a25159fe5cbd90d971c04e22
Instruction ID: aa34f04f89ff587dcee3207a1e9dd181915d2679286371070ca3a84d4d28fc73
Opcode Fuzzy Hash: 374651680ad5ff2d98021a8d98523d7e777448e2a25159fe5cbd90d971c04e22
Instruction Fuzzy Hash: 7631E0B0C012589BDB20CF99C588BCEBFF5BB48314F248059E904BB350C7B55845CFA5

Function 058B9BA9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d426b690cb483b0ed1beafbef2a4b78889aea20991f69ab4a78bcdb04c967b1
Instruction ID: ace4b0a3212640b83e95f8ff534f03d4461182e22123ef6e21f8f8faf7aa0aad
Opcode Fuzzy Hash: 8d426b690cb483b0ed1beafbef2a4b78889aea20991f69ab4a78bcdb04c967b1
Instruction Fuzzy Hash: 3F21B374A00908DFD704DF9AE684989BBF1FF88300B6280D5D548AB365DBB1DE20DF05

Function 0103D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153018465.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_103d000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c73d5e1cde5570b19e7d84fdb3a4c792a81ee92aed8fd54a23e2a3193184172e
Instruction ID: b0f3aaf222c6402c45d46eddf25d447e46c8ff66a1e2601be18d87c648d117e1
Opcode Fuzzy Hash: c73d5e1cde5570b19e7d84fdb3a4c792a81ee92aed8fd54a23e2a3193184172e
Instruction Fuzzy Hash: 342183755083809FCB02CF64D994711BFB5EB86214F28C5DAD8898F2A7C33A9816CB62

Function 058BBC2B Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4141283ed316c8bf882d23d66d55ae642c892f75fc15ca34046809960cf9b57e
Instruction ID: 992d3af56649c8d5ba7fc6031ea0f545be87c8b74cf75c696f4b07bf84f4d468
Opcode Fuzzy Hash: 4141283ed316c8bf882d23d66d55ae642c892f75fc15ca34046809960cf9b57e
Instruction Fuzzy Hash: A6119175A0031A5F9B11EB7988548BFBBFBFBC4250714452AE865D7340EF709D0587A1

Function 058B9BB8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1353da2a8824308cfce4048ec3ec3ca1303f3f9d4a77a6e3a1d1a1b5767c11dc
Instruction ID: 0b64a7d576794a97332762b32e6dcc830753142d93963054c5167f56da4d358f
Opcode Fuzzy Hash: 1353da2a8824308cfce4048ec3ec3ca1303f3f9d4a77a6e3a1d1a1b5767c11dc
Instruction Fuzzy Hash: 2D218074A00908DFD744DF9AE284999BBF1FF88310B6281D5D948AB325DBB1EE20DF05

Function 0102D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152993211.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_102d000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137f5766051e4324e45f0217ede9c43a14289fab1ea42f994ba2cff73d56ee7c
Instruction ID: 075b66ad6c244ee97dfc20cab53033ab2d0f1a2f9bffd4c2d222ad089f428178
Opcode Fuzzy Hash: 137f5766051e4324e45f0217ede9c43a14289fab1ea42f994ba2cff73d56ee7c
Instruction Fuzzy Hash: 8F21E176404240CFDB06CF44D9C4B16BFB2FB85324F24C1AADD480B656C33AD82ACBA1

Function 0102D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152993211.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_102d000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: 5a7f2bd1c9dca4f9ceb5a43bb7e0ba6c7a15b769b0c804e117969c544b189685
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: B6110372404280CFDB02CF54D5C4B16BFB1FB84314F24C6A9D8490B657C336D85ACBA1

Function 058BBB24 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8775c682ee7dbcd89ede4302257388cc39335f943a653fd41da8830682b34b1
Instruction ID: 5e597b20bdbbe99e888f8eed49048fcaf1b9d660642eb588c63917592cff0473
Opcode Fuzzy Hash: b8775c682ee7dbcd89ede4302257388cc39335f943a653fd41da8830682b34b1
Instruction Fuzzy Hash: 3721C4B5D002499FDB10CF9AD884BDEBBF8FB48314F508419E919A7310C375A955CFA5

Function 058B67B2 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d42ba95718fc1969cc733d2877dbb7606fa49f56e57c6212ca5ef3c30cc3bb48
Instruction ID: 5df93cb787f9c5aabc3e83e433b6bf5131588345c54385b6044989055367535a
Opcode Fuzzy Hash: d42ba95718fc1969cc733d2877dbb7606fa49f56e57c6212ca5ef3c30cc3bb48
Instruction Fuzzy Hash: 87214734615A409FE711CF6AE896D6A7FB8FB46300B144446EC52CB711EA75FC06CF15

Function 0103D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153018465.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_103d000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction ID: 17fe14c9ac63fbf3cd0b4461454bfd9616813a6ec2c1f8b944fdb21316acc3d3
Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction Fuzzy Hash: 8511BB75904280DFDB02CF54D5C4B15BBA1FB84224F24C6A9D8894B696C33AD41ACB61

Function 058B9E49 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c7ca33d833b6bb274cae3e4768c924736983012c067c67167163d8f2e607a6
Instruction ID: 2ff00ca9110e553cfa268dcd9e3c143e988236b379bf6c31db74553bc86a80b9
Opcode Fuzzy Hash: a5c7ca33d833b6bb274cae3e4768c924736983012c067c67167163d8f2e607a6
Instruction Fuzzy Hash: BB118D74D4924EDBEB00CFA8C4849EDBBBABB09218F10541AEE5AFB341D3B55D41CB24

Function 058BBEEF Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1103325f80ea4bcc63bb387625a7820928b47cfb1f55b32317dea78a64cda2a0
Instruction ID: 159c543826d4df86c2c7464361500dd84a0263cd0a1d409cef5a6fe10f00ae5c
Opcode Fuzzy Hash: 1103325f80ea4bcc63bb387625a7820928b47cfb1f55b32317dea78a64cda2a0
Instruction Fuzzy Hash: 5111EC71904208DFEB15CFAAC4447DABFF5BF49365F24C169E8189B350C6B44985CF94

Function 058BDAA9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e48476598809c513589640981d74a0e7439526241f85b6cd76ec82663b22adb4
Instruction ID: 45e1b896d04a5b85f7a6fe785f4967fcdcaa5d900f8135cd49b05cc80d764c7e
Opcode Fuzzy Hash: e48476598809c513589640981d74a0e7439526241f85b6cd76ec82663b22adb4
Instruction Fuzzy Hash: 57014F343596849FE315CB25C849F927BA6BF46710F1990D9E5068F2B2D761EC40CB05

Function 058BDAC0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98dc4bb8f5dc30a5604239691680cfd538d65ce34453c360c559bd47031005a5
Instruction ID: c7792088149836801f814d198cd4ad3c3da2f936197da2c45988d97d35ba2450
Opcode Fuzzy Hash: 98dc4bb8f5dc30a5604239691680cfd538d65ce34453c360c559bd47031005a5
Instruction Fuzzy Hash: D0014C3075A6849FE315DB29C855B627BA6BF87700F6A80D6E506CF3B2DA65DC01CB02

Function 058B6080 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53909c9d7e8feedb7a01908ca08a33318b9e1a0aecfa2ff7fe8f6736a36ed91d
Instruction ID: cda57d23d77a9dec421a352b3a1bb6d3a9bde636758da5834e0e2db7a5307c92
Opcode Fuzzy Hash: 53909c9d7e8feedb7a01908ca08a33318b9e1a0aecfa2ff7fe8f6736a36ed91d
Instruction Fuzzy Hash: 31016432B086059BD308DF5B9A81542BBAFFFC420031AC037990CC7252EB709C19C291

Function 0102D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152993211.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_102d000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe251a0112a0e84673ff9e07dc759d5b4dec84e5cf602ae671729a4b4844942c
Instruction ID: 74614e361d04800248fce31f5a8776e75f4f92a8461d86ea76e706e70340e741
Opcode Fuzzy Hash: fe251a0112a0e84673ff9e07dc759d5b4dec84e5cf602ae671729a4b4844942c
Instruction Fuzzy Hash: 9001D6711053909AE7508AA9DCC4B6BFFE8FF41724F18C85AED894A286D37D9C44CBB1

Function 058B64B0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a62dc31deb00c723ac6e15a0e03d1e047bd082f762d880e24179bc27dcecffd
Instruction ID: 6787b71322430543247f1f1fca731a82a874676fb04bf6254fb14a6069e242da
Opcode Fuzzy Hash: 1a62dc31deb00c723ac6e15a0e03d1e047bd082f762d880e24179bc27dcecffd
Instruction Fuzzy Hash: 52017C39A10218CBD7189B36D4554AABFBBFF88721B00456EE90687350DF71A811DB91

Function 058BB719 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3869043d02ba8718a556991f156421fa0b7241453accc3bc8317cfc85adde031
Instruction ID: 6dd737b7bfb2136c456a82803e583d3887291ddd73da207ac99190aef2d19dc5
Opcode Fuzzy Hash: 3869043d02ba8718a556991f156421fa0b7241453accc3bc8317cfc85adde031
Instruction Fuzzy Hash: 1F018F72D0D3869FDB42EBB898045DEBFF8AF06211F1840B7C588D6252E3358919CB96

Function 058B6090 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44ec3daab92df5f69418fcc4271a76795b1046e376799c2fded814d14f571ad
Instruction ID: fece0b35c4cc096b3d76604aa7554aef43daab443e95d427c9fd5144f0955de4
Opcode Fuzzy Hash: d44ec3daab92df5f69418fcc4271a76795b1046e376799c2fded814d14f571ad
Instruction Fuzzy Hash: 13F0FF72B08519A7A708DE6B9A81553FAAFFBC8250314C53BA909C2350EFB0AD11C6D1

Function 058BBEF8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6872b2a6f7f41d61062c64dc08ee91635c32c0d7bf4a50a07a5334c146929b
Instruction ID: 558e18d7c9e68acdf4bf47ded33fe4929bfd63e3ddd91e2dca1b485d08797bfc
Opcode Fuzzy Hash: bc6872b2a6f7f41d61062c64dc08ee91635c32c0d7bf4a50a07a5334c146929b
Instruction Fuzzy Hash: 2C01C970900208EFEB14CF9AC4487DABEF5BB48361F24C169E818AB390C7B48985CF94

Function 058B9028 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b26dec91a3fc580b99535c31fa63d246dba7aef22625e452eb1e899c6728c4e
Instruction ID: 714d938d4cd2754cae1eab707f3bc8353ea076d7f28f05bc4b297a0cee611e4d
Opcode Fuzzy Hash: 6b26dec91a3fc580b99535c31fa63d246dba7aef22625e452eb1e899c6728c4e
Instruction Fuzzy Hash: 0D0128357001058FC740DA38E844A5A3BDFEBC9356F004475F60ACB368CE71AC538752

Function 058B902A Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c38e75c8a7327b9670643420d8c2f0ec54e873366cb254916b1354a4ddc156
Instruction ID: 1f3ed5a311f1ad5ef6cded5d3687019fb425bd4ee9745318566d34e9b526b7e1
Opcode Fuzzy Hash: 97c38e75c8a7327b9670643420d8c2f0ec54e873366cb254916b1354a4ddc156
Instruction Fuzzy Hash: FFF04C357001058FC740DA38E444A693BDBEBC9356F004475F60ACB368CF71AC538752

Function 058BC19C Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddc831ab9aff13db12bc1450f0519ca97117fe62cd07cca8dcafcef345c4827
Instruction ID: b8cc1b4f2a1b9f1ee6d8e0e2df0cea60dab9aaeacd8789193d6c54885a80bf26
Opcode Fuzzy Hash: cddc831ab9aff13db12bc1450f0519ca97117fe62cd07cca8dcafcef345c4827
Instruction Fuzzy Hash: 2C014C7080421ADFEB21DFA9C8043EEBBF5BF04314F208216E865EB2A0D7B44D41CB91

Function 058B9DF9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59b40976632ed5fb7430c3eab058d900df85f6912f015d9015af87c15128bc2
Instruction ID: 48b6af7c8c10e1ce2d8600ee6919ab836a874d5d5c87461e6edd6433bac4d520
Opcode Fuzzy Hash: e59b40976632ed5fb7430c3eab058d900df85f6912f015d9015af87c15128bc2
Instruction Fuzzy Hash: ACF04930D0E249DFD7128BA4C8045FEBFBAAB46310F04455AE996E7351CBF41D00CBA2

Function 0102D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152993211.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_102d000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e553f1e9e1dee346de12e6546bfbf03114c34e1c3b7eeffcabc7700ae36641
Instruction ID: b0f68a2a88ca53f525939537f7dd9c2db83843f4b20fd6d37ecf34bbf601a852
Opcode Fuzzy Hash: a6e553f1e9e1dee346de12e6546bfbf03114c34e1c3b7eeffcabc7700ae36641
Instruction Fuzzy Hash: A6F0C2714043809EE7108A0ADC84B62FFE8EF40724F18C49AED484B286C3799C44CBB0

Function 058BCFD8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e9f759fab96c970baf4caf4e267a4e9ffd77b9df5b6baab6c01430ae2f9c6c
Instruction ID: 92c05839d2fdbac08a8f4fbd69a767d5b49b9fc5bbea418d937a55b0ee3063df
Opcode Fuzzy Hash: 03e9f759fab96c970baf4caf4e267a4e9ffd77b9df5b6baab6c01430ae2f9c6c
Instruction Fuzzy Hash: 02F09A32605218AFEF08EBA8DC059DEBFBAEB04220F04C16AE508D7210E671E9008795

Function 058BC238 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e584c95b1960d62c2c9c8082d4930a05002d71e2823c7234f4b14484329bfec7
Instruction ID: f0018d7f224abb4def89c93c193a6044b7314a5137a59fdace1e92d1a59dc861
Opcode Fuzzy Hash: e584c95b1960d62c2c9c8082d4930a05002d71e2823c7234f4b14484329bfec7
Instruction Fuzzy Hash: 83F03AB2B082286FD3049A6A9898D67BBE9FF8D26171581BAE548C7351D9349C0087A4

Function 058B7120 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa3b9bb18bddd99ccd98bd2942029877bfafc0fcbbc03668f58e1d5b5fb40d8
Instruction ID: 5c13435116392ecd43a0d37cabe1cb1fec5fb6cc265262d6cd8343f164f9efd8
Opcode Fuzzy Hash: daa3b9bb18bddd99ccd98bd2942029877bfafc0fcbbc03668f58e1d5b5fb40d8
Instruction Fuzzy Hash: 31F02BB174075257D3198A2A5C1066BFBDFEBC4251B06C82BE54BC7254EA7099124A90

Function 058BC1A8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e899281e3f9aebcc7c23651a5f815fdf57332952dc07bfe9f0e05e9fc3199d71
Instruction ID: 1211f1814893c8c1e940477ca45c000a29781689609a50989dc92aab236e58d4
Opcode Fuzzy Hash: e899281e3f9aebcc7c23651a5f815fdf57332952dc07bfe9f0e05e9fc3199d71
Instruction Fuzzy Hash: 0E01DA7080421ADFEB14DF95C4047EE7AF5BB44350F108625E825EB2A0D7B44E44CB95

Function 058BB290 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bce5e85e8fa911e16809556e162b9411c6758940df91f9dba2445090ca7ab3
Instruction ID: 15eda2cc9111741c2271fa717f20482730d163982055fb83ae556ed7bf28a1a3
Opcode Fuzzy Hash: 53bce5e85e8fa911e16809556e162b9411c6758940df91f9dba2445090ca7ab3
Instruction Fuzzy Hash: 67F0A7357001145B9B5496BDA01882E37EFABC96563554477E90ECB364DDB0DC028B91

Function 058B7130 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8478ee3828951573c8e490df4d2dac16014b5e9fd0ea46ffa443160341b37173
Instruction ID: 2013970614608120436866a0cab92dd8f5f6b8bfc8b0f90c07dd29f64b934b99
Opcode Fuzzy Hash: 8478ee3828951573c8e490df4d2dac16014b5e9fd0ea46ffa443160341b37173
Instruction Fuzzy Hash: A9F0273131075647D3189A2B980086BFBEFFBC5250705C83BE50BC7310DE70E90286E0

Function 058BC248 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86e6176e9c32212d632c4361001b29205ed887e7a36d48470615e251ed7c904
Instruction ID: 216a25596292f104bcf075e013e41cfbc57b0002d26e44f71c5f230029cedd2b
Opcode Fuzzy Hash: b86e6176e9c32212d632c4361001b29205ed887e7a36d48470615e251ed7c904
Instruction Fuzzy Hash: 78E03972B041286F93049A6EEC84C6BBBEDFBCD660311807AE508C7350D9319C0086A0

Function 058B64A2 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5269ab6cd9e46ef04daada8c123648506785d8811bfcad3de56a4a6e8f6c70
Instruction ID: f52a956e7ce4f90c8e5f145f562b3fdc0f8a900615d89bfda20f659e96e579b2
Opcode Fuzzy Hash: df5269ab6cd9e46ef04daada8c123648506785d8811bfcad3de56a4a6e8f6c70
Instruction Fuzzy Hash: 98F02E75F105148BE7098A7689115AD7EBBAFC8350F05413BE401D7394EEB05C1487C0

Function 058B71A1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7beebd0143ecb605525fef736d0a0f40e78f4d8d8bdc568d306297699e41b8d
Instruction ID: 573199567cde8b7d15792f1c1d3189ee2c1e73a39cfaec1c5a76505e0b83dd1d
Opcode Fuzzy Hash: b7beebd0143ecb605525fef736d0a0f40e78f4d8d8bdc568d306297699e41b8d
Instruction Fuzzy Hash: 44E0D8B6B046105BD30897A65C05B6BBBDAAFC8721B05C05AA409D77C4DD706C018AD0

Function 058B50B7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918ffdc4c42933e96bc62bcbc9429659be0eec2a29cffde79f3fca0cff03d093
Instruction ID: f3070e992ec7693f0cc6a7582ea98311f6421c465864dae2a2d965245e5418d6
Opcode Fuzzy Hash: 918ffdc4c42933e96bc62bcbc9429659be0eec2a29cffde79f3fca0cff03d093
Instruction Fuzzy Hash: D5E0D8B341012167F200EA1CCDD19EA3BD4EF613447D44C42E848C9220E614C90AD699

Function 058B8FC8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63320a6719503fcfded666b4e9eabe9693616efb030450354122dbc9fbd134f3
Instruction ID: 4e1cdc960fab877e224ff633aed3205e99830fa09353f4eda739ccb87579d33b
Opcode Fuzzy Hash: 63320a6719503fcfded666b4e9eabe9693616efb030450354122dbc9fbd134f3
Instruction Fuzzy Hash: E0E0D8B6B000008FC740DBE89D09A163BE66B8C7127118096F605CF3E4DE708C114F52

Function 058B71B0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1814aaabcd11fc04a574b7cc5ac84e4d7ac672fe8646c59438a60d0ff81e1e45
Instruction ID: dfbb8beb80d2f1ec762252bc5974131dbf3f6dbd91b8524722bfe1e41a1af6f5
Opcode Fuzzy Hash: 1814aaabcd11fc04a574b7cc5ac84e4d7ac672fe8646c59438a60d0ff81e1e45
Instruction Fuzzy Hash: ECE0863570462417D218566B5C00A6BBBDEEFCD720B14C069E419D7344DD707C0186D4

Function 058B8FD8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca63e72fd3701fa6572c0a2c5749e924ccb92629a6c0960c1fc4249008e69856
Instruction ID: b8b7c0544b9dc4ae6bf5c640aa0f18fee7cc9b98452de1e0bd74fccddfa49a56
Opcode Fuzzy Hash: ca63e72fd3701fa6572c0a2c5749e924ccb92629a6c0960c1fc4249008e69856
Instruction Fuzzy Hash: 8CE086757000144F8740EBACD80491A3BEAAB8C6113108065F60ACB394DE749C024F95

Function 058B9F16 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d55f5036c4d0d48c800924d4dd1bb506bef40c99f1ee6018f9fae8ed89d6fb3
Instruction ID: 26b625154d1e56be59b0ff23f59263b774be46a2e473458a459883b9b6458502
Opcode Fuzzy Hash: 4d55f5036c4d0d48c800924d4dd1bb506bef40c99f1ee6018f9fae8ed89d6fb3
Instruction Fuzzy Hash: D2D0A932E8900CDBDB10DAE8E8844ECFB39EB8A222B044422DB47E3700C7F00C29CB05

Function 058BCFB0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b7b6521748bad435d9550b036e365429a1d9c4cd35216eafa585f09cc5b146
Instruction ID: 4a53b15951516ff5da78b2c1f9180bc221218d7ba7b87abb66f1ad9de89e759e
Opcode Fuzzy Hash: f0b7b6521748bad435d9550b036e365429a1d9c4cd35216eafa585f09cc5b146
Instruction Fuzzy Hash: 0DC0126651C3C03FE703523094058C32F740B177107178487E180890B394640999D777

Function 058BF928 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051e6e636c052db1a8b40f4bc2bdf598ddb8c3dc6c0e2af6b225b8d9b3a7258f
Instruction ID: fe92060296731e4c24b3d495e19ffdee4a96d1f49c129db56f2de29d672162aa
Opcode Fuzzy Hash: 051e6e636c052db1a8b40f4bc2bdf598ddb8c3dc6c0e2af6b225b8d9b3a7258f
Instruction Fuzzy Hash: 4BC04C3004560C8BD6146BADA94D3B87FAEE701316F441121E74E85560DBF45860C657

Function 058B9920 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b3e48f08b917399a9058a7dbea7f96c88cc79c6b7c6f49e0897952f9ff3a808
Instruction ID: c31e67a653626c06d435efa19433d54a9e02972c2c27b4778ac718fe5d3e9183
Opcode Fuzzy Hash: 9b3e48f08b917399a9058a7dbea7f96c88cc79c6b7c6f49e0897952f9ff3a808
Instruction Fuzzy Hash: D0C0925364D3C11FD70B03A54C22D40BFA00C6348430F50C39189EB5F3D020CA65E766

Function 058BA2B8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db12d9d0aba87f9a6abfa75267bc7e09604a89062330f82cd26271f0087278a8
Instruction ID: 531617a1ed374790737bf39a71718e21b7b14e9596de4158fda2bdc259f8ef4b
Opcode Fuzzy Hash: db12d9d0aba87f9a6abfa75267bc7e09604a89062330f82cd26271f0087278a8
Instruction Fuzzy Hash: 2CD0EA74D0820DCBEB54CF94D5886EDBBBAEB49309F204015D81AA6350D7B56D868F41

Function 058BBACC Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629432db03a57f21b7541394455cb8c7720df774466de00b3a5d3bce10159465
Instruction ID: 992f595d053c166640bfea88f493319c330f653b57bada972ece4140abaa35fe
Opcode Fuzzy Hash: 629432db03a57f21b7541394455cb8c7720df774466de00b3a5d3bce10159465
Instruction Fuzzy Hash: 35B0127B3F960BA2B00862684C949AB5465FFA2B01F90DC017A488021485F05C6A997F

Function 058B891C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5ee535ce72543bc4df31ac1c592b9d5ae28ec8da833ee5a06eaa3ff9bc3207
Instruction ID: 0c71c119e2c7aea5f0bea79dc5102e09a73f676e33bf35b55f3f01b0b244571b
Opcode Fuzzy Hash: 0f5ee535ce72543bc4df31ac1c592b9d5ae28ec8da833ee5a06eaa3ff9bc3207
Instruction Fuzzy Hash: 83C02B30D2022D85D200EB74E840C8C236FEB4060030009245804821A2C5907C105D03

Non-executed Functions

Function 0707BDB0 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PHcq, xrefs: 0707BF9B
PHcq, xrefs: 0707C073

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: PHcq$PHcq
API String ID: 0-4229179212
Opcode ID: bda9c6d06b36edfe882d384ee2e691534241704ab9a09a0c6e2363fa60cf43ce
Instruction ID: 44dad94c518acbe87867ba391e1e07e870b618c878ec587c7883874af7d0f75c
Opcode Fuzzy Hash: bda9c6d06b36edfe882d384ee2e691534241704ab9a09a0c6e2363fa60cf43ce
Instruction Fuzzy Hash: 23D1B2B4A006098FDB58DF69C598AA9B7F1BF8D701F2581A8E505EB361DB31AD40CF60

Function 058B51E4 Relevance: 2.7, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058B596D
Tecq, xrefs: 058B5ACA

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq
API String ID: 0-2088518435
Opcode ID: e47cf752167e0e6d771a505c44edb38396372473f5c56452c832c63ed5316d01
Instruction ID: 6f5f1ffd82ffc6bc2ddac5cbf7508fad5997e809b84a12d0966af03f7830c30b
Opcode Fuzzy Hash: e47cf752167e0e6d771a505c44edb38396372473f5c56452c832c63ed5316d01
Instruction Fuzzy Hash: A171C370B101098FEB04DF69D8919AEBBFAFB89304F15811AE901DB351EB71AD05CF91

Function 058B5940 Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058B596D
Tecq, xrefs: 058B5ACA

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq
API String ID: 0-2088518435
Opcode ID: 04573b8f339557fb46f61fcc922b5dca35c3b0592ff29ae4352916c9d0f7002b
Instruction ID: 9dae7fb6744f6138f600cac62f42396f3658bbe0c2cd3b8f47e89f903d694a25
Opcode Fuzzy Hash: 04573b8f339557fb46f61fcc922b5dca35c3b0592ff29ae4352916c9d0f7002b
Instruction Fuzzy Hash: 1F41E971B100198FEB08DF69D9556BEFBBAFB98314F11412AD502EB390DAB19D01CF91

Function 058B5950 Relevance: 2.6, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

Tecq, xrefs: 058B596D
Tecq, xrefs: 058B5ACA

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Tecq$Tecq
API String ID: 0-2088518435
Opcode ID: 11bdafddac5d0be153512399cf9de49d34c1e5065a311cc8d1a70d32c6238859
Instruction ID: 53b7fedaaa2d26f300a838a19934705f12dddec6192834a588a67f66a1540cba
Opcode Fuzzy Hash: 11bdafddac5d0be153512399cf9de49d34c1e5065a311cc8d1a70d32c6238859
Instruction Fuzzy Hash: 4941E871B100198FDB08DF69D855ABEFBBAFB88314F11412AD902EB390DA719D01CF91

Function 058B4888 Relevance: 1.6, Strings: 1, Instructions: 348COMMON

Download Yara Rule

Strings

Hgq, xrefs: 058B4A70

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: Hgq
API String ID: 0-2103768809
Opcode ID: 8d7234e953525b92a4eb3aa213a1934c635f4bd581d872ea23b0beae670008be
Instruction ID: 5ed7ee45862e69cf3620c1ec536df084ee5ed6c7d1cb1b06c79702a3124c8137
Opcode Fuzzy Hash: 8d7234e953525b92a4eb3aa213a1934c635f4bd581d872ea23b0beae670008be
Instruction Fuzzy Hash: AAD184B5A102199FDB04DFB8D8546AEBBF6FF88300F108469D449EB395DB34AD41CBA1

Function 058B8140 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

ax^, xrefs: 058B81FE

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: ax^
API String ID: 0-994873808
Opcode ID: 5f299271c9ca40fee71ebd2ff28ed14b5b943f8ee8b6ca61af30c73131c200a7
Instruction ID: feeba9e9ddc37976f862c8b604823dab7fa057f46ae9218867e36cb78a533f19
Opcode Fuzzy Hash: 5f299271c9ca40fee71ebd2ff28ed14b5b943f8ee8b6ca61af30c73131c200a7
Instruction Fuzzy Hash: 3C41A079F1120ACFDB44DF99C8859EEBBBABB88304F15852AD905EB350D2B4CD018E61

Function 058B8150 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

ax^, xrefs: 058B81FE

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: ax^
API String ID: 0-994873808
Opcode ID: dad259ecc5e49ef042380b0164620bdf37b4d8a218a74231cd167962496c5be0
Instruction ID: 5aefb8559327d9754742abe057b80998cf0f789b29a256d41f469c210c33b0d4
Opcode Fuzzy Hash: dad259ecc5e49ef042380b0164620bdf37b4d8a218a74231cd167962496c5be0
Instruction Fuzzy Hash: CF418279F1520ACBDB44DF99C8858EABBBEBB88304F15852AD905EB350C674DD018E61

Function 052F0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161036198.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52f0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1282da783d7158fb7507cda7e99d7958852b95f4f7e17c215f524ec8c0ea4007
Instruction ID: 5cf888bfc1deb05de4d4ad7be6da84d9b2ec911536f51c5e792e37051e87aa32
Opcode Fuzzy Hash: 1282da783d7158fb7507cda7e99d7958852b95f4f7e17c215f524ec8c0ea4007
Instruction Fuzzy Hash: 8012B8F1C817459AD330CF65E94E5893BB1B741398FD04A09D2A12F2E9EBB416AACF44

Function 070744D8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c31595a812d3bf2fe1d19a52b99ea72f936ee9bdb6d3344418ab8b30897c2b
Instruction ID: d8cc73087f5ebdda2bc91c3a24334094feed0acd7af23e4e5e0c3a75e5413858
Opcode Fuzzy Hash: f4c31595a812d3bf2fe1d19a52b99ea72f936ee9bdb6d3344418ab8b30897c2b
Instruction Fuzzy Hash: F7E109B4E012598FCB54DFA9C5809AEFBF2FF89304F248269E414AB356D730A941CF65

Function 070763F0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90690d70e05dd2fc30f34235d2039a5a14d141c48322c4637b0edbd3bdbedc97
Instruction ID: 3422e78543b91c95869037eab143279dc4d6df8c45147489bdfc2d0c3166485d
Opcode Fuzzy Hash: 90690d70e05dd2fc30f34235d2039a5a14d141c48322c4637b0edbd3bdbedc97
Instruction Fuzzy Hash: ACE128B4E016198FCB14DFA8C5809AEFBF2FF89304F248269D415AB355D731A981CF65

Function 07075FB8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7638a0ec7e104d33c7ce2e2ee9f52353af4ee01543c730d11713225bb005a5
Instruction ID: 383fa25370cb5a3f0ae1c2af9fb3c73b4c6f6668971ec3250acb7a216c9fcda3
Opcode Fuzzy Hash: 5a7638a0ec7e104d33c7ce2e2ee9f52353af4ee01543c730d11713225bb005a5
Instruction Fuzzy Hash: 88E138B4E006198FCB14DFA8C5809AEFBF2FF89304F248269D415AB316D731A941CFA5

Function 07074910 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ca2b0bf6240318575829b0bdc931adf9fa9c0317e850eedfc81de1513ba8db
Instruction ID: d68661bfdefd86788a20bba3023fcba3f8c4689235d331b8c0cc113dc40c4fbb
Opcode Fuzzy Hash: e8ca2b0bf6240318575829b0bdc931adf9fa9c0317e850eedfc81de1513ba8db
Instruction Fuzzy Hash: 9AE106B4E0125A8FCB54DFA9C5809AEFBF2BF89304F248269E414AB355D730AD41CF65

Function 07076828 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba7bde4d7a06cee55a40cc3e7101a08499be650b096441a189c7ae5e03a6716
Instruction ID: 8feeefee0107425674e2b485945f422cf73fce95af7fefc8722552c5a448813d
Opcode Fuzzy Hash: 5ba7bde4d7a06cee55a40cc3e7101a08499be650b096441a189c7ae5e03a6716
Instruction Fuzzy Hash: 57E128B4E006598FCB14DFA9C5809AEFBF2FF89304F248269D415AB315D731A981CF65

Function 058BC7B0 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31dba9f66b235bd28f4fc4308823ffe4d3e44e503f3b1408505a6120560443cd
Instruction ID: 8eb94af34aa364934ebbd84cc978817e74c20a902738392a470fb0a5cc79e072
Opcode Fuzzy Hash: 31dba9f66b235bd28f4fc4308823ffe4d3e44e503f3b1408505a6120560443cd
Instruction Fuzzy Hash: 32D1063191075A8ACB10EF64D99069DB772FF95300F20DB9AE50A3B224EB706AC5CF91

Function 058BC7C0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f501673c2210701cd0b4a8764f7c4b149786c324ac1a78550eaa14e6a151a95a
Instruction ID: 0e60bef0ff16274c02675a2f66aee7c4e9284af166c1db5b131076d46c45f576
Opcode Fuzzy Hash: f501673c2210701cd0b4a8764f7c4b149786c324ac1a78550eaa14e6a151a95a
Instruction Fuzzy Hash: CCD1073191075A8ACB10EF64D99069DF772FF95300F20DB9AE50A3B224EB706AC5CF91

Function 0133DDEC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153505804.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1330000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5d42b37e347816353656b2f8fbb2986643b982dcc734c991644add94e6a87b
Instruction ID: 6d161b7a8d1548228d79560f8fea8f6afe895ef77de012b8aace98d2ba201a16
Opcode Fuzzy Hash: 0a5d42b37e347816353656b2f8fbb2986643b982dcc734c991644add94e6a87b
Instruction Fuzzy Hash: 55A18E32E0020ACFCF05DFB8C88049EBBB6FFD9304B55856AE905AB265DB31E915CB50

Function 052F0006 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161036198.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52f0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7876e0917d15f8105b665f2fbf0668f54443935df7b4efad479d62118ce02a
Instruction ID: b04e7ba9bab3d28fa225a35723cebd5bb41d254eec2a3dda30ded775fe39a646
Opcode Fuzzy Hash: 1a7876e0917d15f8105b665f2fbf0668f54443935df7b4efad479d62118ce02a
Instruction Fuzzy Hash: DBC15AB1C817459FD720CF24E84E5897BB1BB81394FD04B09D1A16F2E9EBB416AACF44

Function 052FE8E0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161036198.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52f0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6c8f3bc758ce1d7281ed104b4e97dc9a2460d9611845e5bbf1db0711ec55cc
Instruction ID: 5dc7e8d05b4c620ffb4cbe0eb37478cd5da58526014bc4b133689cd421d3990f
Opcode Fuzzy Hash: ae6c8f3bc758ce1d7281ed104b4e97dc9a2460d9611845e5bbf1db0711ec55cc
Instruction Fuzzy Hash: EA71E571620A068FE775CF38D481A96B7F6FF89304B054E29E2A6CB660D774F845CB90

Function 07074900 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162634051.0000000007070000.00000040.00000800.00020000.00000000.sdmp, Offset: 07070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7070000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e627ece820d1fba02091bab714dff2177451dc20d06fdb341843355367d56e1a
Instruction ID: dd8bad4616f5c66cf844b0f1844c607ba522385c33805909e48c1d484a742418
Opcode Fuzzy Hash: e627ece820d1fba02091bab714dff2177451dc20d06fdb341843355367d56e1a
Instruction Fuzzy Hash: 9B512DB1E012598FCB14DFA9C5805AEFBF2BF89304F24C26AE418A7315D7309941CF65

Function 058BCD60 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872f057a79c2af0ea6ba25a5ad356fc510b03607d1a41769fc3d160c14e04cab
Instruction ID: a964091ffad9d3d7f0cfdbf28c5af58a431e89d1c3c25360e9314388d19ae279
Opcode Fuzzy Hash: 872f057a79c2af0ea6ba25a5ad356fc510b03607d1a41769fc3d160c14e04cab
Instruction Fuzzy Hash: 0F419235B0521ADFDB44CFA8C9418FEBFBBEF89204B14955AE905EB350D6B18D428B81

Function 058BCD70 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d78a47ad3212cb4d5ca259969f56a6fd3a31e7174973f29254c7ae9b389d50
Instruction ID: 5da87509cd6a3d0b188044d1ae0b8e091bebcda4327bfafc7a1d3b23ad86b3a2
Opcode Fuzzy Hash: c7d78a47ad3212cb4d5ca259969f56a6fd3a31e7174973f29254c7ae9b389d50
Instruction Fuzzy Hash: 5B41A435B0411ADFDB44CFA8D9418FEBF7BEF89204B54541AED05EB350D6B18D428745

Function 058B5E0A Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e534a7c40a5cca4e4995f4de9480b11786d524586f1f2c48f2e2364665f87b05
Instruction ID: 8b155cbccd301ce0ba4295ca4560dcf3409b69c21a98cc16b09f9627c93eaebd
Opcode Fuzzy Hash: e534a7c40a5cca4e4995f4de9480b11786d524586f1f2c48f2e2364665f87b05
Instruction Fuzzy Hash: 2E3104B5F041198FD708CF99D5915BEFBFBEB88600F118066E899EB390D6B1DD028A51

Function 058B75F8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e147996d967a2e8ffb9ab13605ec2676548ca5a4f3225c01b28516fcaeb113ed
Instruction ID: 8b3253e04de3680ed7ce366623cdc8ed4ba2b8ba1bc434248af8dfcdfd282a43
Opcode Fuzzy Hash: e147996d967a2e8ffb9ab13605ec2676548ca5a4f3225c01b28516fcaeb113ed
Instruction Fuzzy Hash: 1241D135A10706CFD760CB6DC889AAABBF6EFC5340F15883AE45ACB660D674E941CF41

Function 058B7608 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162249858.00000000058B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58b0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f851111587c460cad148981ed7ef726a588af9eb88b1b2fdd0653b8537c543
Instruction ID: e560d93deddfc0855bad947773bd48b5fed605c1a978264aaa49d5fe71b22dfc
Opcode Fuzzy Hash: f9f851111587c460cad148981ed7ef726a588af9eb88b1b2fdd0653b8537c543
Instruction Fuzzy Hash: 7E41BF35A1070A8FD760CA69C8889AABBF6EBC5314F14882AE41ACB764D674E941CF41

Analysis Process: SOA Payment for June 30th.exePID: 6408, Parent PID: 1576COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.8%
Total number of Nodes:	166
Total number of Limit Nodes:	23

Executed Functions

Function 06A13140 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A1388C
$cq, xrefs: 06A1384B
$cq, xrefs: 06A1383F
$cq, xrefs: 06A13874
$cq, xrefs: 06A13868
$cq, xrefs: 06A13898

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-2877684506
Opcode ID: c1a7ae24338fefb1155bbf0ab4e541c14a30a44741a15a85aad1507ad5559125
Instruction ID: 8da635e471664eac7a3f92aba6dc77b8f0228fa143209c39bc8355fe730107d6
Opcode Fuzzy Hash: c1a7ae24338fefb1155bbf0ab4e541c14a30a44741a15a85aad1507ad5559125
Instruction Fuzzy Hash: AC323F31E1061ACBCB14EF75C99459DB7B6BFC9300F60969AD409AB264EF30A985CB90

Function 06A17E68 Relevance: 3.0, Strings: 2, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A181D7
$cq, xrefs: 06A181CB

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq
API String ID: 0-2695052418
Opcode ID: 6ad3d3409a17c5344a37ef636b2ec51d9788f845a7c4515bdf70fb8ebc23975d
Instruction ID: 6c6c35a65ff9a440f1a27beb80dff8c047b65ca90879cdb25fa1b55083248a95
Opcode Fuzzy Hash: 6ad3d3409a17c5344a37ef636b2ec51d9788f845a7c4515bdf70fb8ebc23975d
Instruction Fuzzy Hash: 4F029E31B002168FDB55EB68D9906AEB7F2FF84310F248569E8169F394DB35ED42CB90

Function 06A15268 Relevance: 1.9, Strings: 1, Instructions: 607
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06A155BB

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 199d86ab26ea3d2543ccca65209d82c4820f608c244c93c8a72bbbc3033de02d
Instruction ID: 0e2d3a6842a8d2c105bd373bb0e75ca2c828caee2c72372ae63cb623c7fa8ad3
Opcode Fuzzy Hash: 199d86ab26ea3d2543ccca65209d82c4820f608c244c93c8a72bbbc3033de02d
Instruction Fuzzy Hash: 3222A1B5E002198FDF60EBA4C5906AEFBB2EFC5320F248569D455AF354DA31DC41CB91

Function 02BB70B0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02BB7127

Memory Dump Source

Source File: 00000003.00000002.4599135742.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bb0000_SOA Payment for June 30th.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: e063c07dc75d05f4d2fd74beef4c2d0cfdc7af6ffe8ea8c98e725b6102760ea4
Instruction ID: a987ac7a5828d28249dd1ce4e81b45731a9dcff329e7e8495184a7e235bdb90d
Opcode Fuzzy Hash: e063c07dc75d05f4d2fd74beef4c2d0cfdc7af6ffe8ea8c98e725b6102760ea4
Instruction Fuzzy Hash: 8C2125B2D002598FCB10CF9AD884BEEFBF4AF49314F15846AE459A3350D778A944DFA1

Function 06A1C280 Relevance: .6, Instructions: 646COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39d26eb62f688bede1699786a9fbf261c19fcecb44d9198a13d9633f0d8d466
Instruction ID: 24d8d383ca2e6efca0ef3d0cc61d9942f2e7d3c298ea0e061aaf604fc49aef93
Opcode Fuzzy Hash: a39d26eb62f688bede1699786a9fbf261c19fcecb44d9198a13d9633f0d8d466
Instruction Fuzzy Hash: 83328131B502059FDB55EB68D990BADB7B2EB88320F208565E406EF355DB38EC42CB91

Function 06A1B31A Relevance: .6, Instructions: 575COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3322a27889dae7a28f8c9e094c212187a9e139b772c4d36dacd5c25cc441eb8
Instruction ID: f94b1a0eb40226d71af65f6a2b49717d4e54841b42974f372414a38b23164fbf
Opcode Fuzzy Hash: f3322a27889dae7a28f8c9e094c212187a9e139b772c4d36dacd5c25cc441eb8
Instruction Fuzzy Hash: EB228274E1010A8FDF64EB68C5907AEB7B6EB49310F248926E459DF391DB34DC81CBA1

Function 06A1B738 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A1BCA5
$cq, xrefs: 06A1BCD9
$cq, xrefs: 06A1BD0D
$cq, xrefs: 06A1BD01
$cq, xrefs: 06A1BCCD
$cq, xrefs: 06A1BC99

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-2877684506
Opcode ID: f493a382b8c8e056643bc09fd8fce6f4a2907a1b0c90f7007a7a8a27ca63b787
Instruction ID: 26d4d45bd5ec6a99fda6949c8843f8ae096ff048ee6d3dfdc7f9d94be666bc97
Opcode Fuzzy Hash: f493a382b8c8e056643bc09fd8fce6f4a2907a1b0c90f7007a7a8a27ca63b787
Instruction Fuzzy Hash: 4F026D70E1020A8FDBA4EB68D5807ADB7F2EB85310F24896AD415DF355DB35EC41CBA1

Function 06A19240 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A192C2
$cq, xrefs: 06A192CE
$cq, xrefs: 06A19293
$cq, xrefs: 06A19287

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: e279ef8d7d9a4fbee5c56d78448501914e4ab9d64352d4c5434f7d084c148dc6
Instruction ID: ecc2fb71cd6c7f3acd1a0289d77fc07f7c5ef9825207f7d49eed4b81e72a7a69
Opcode Fuzzy Hash: e279ef8d7d9a4fbee5c56d78448501914e4ab9d64352d4c5434f7d084c148dc6
Instruction Fuzzy Hash: 91915D71F1061A8FDB55EB68D9607AFB7F6AF85300F108569D809EF384EA309C46CB91

Function 06A1D048 Relevance: 4.6, Strings: 3, Instructions: 801
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A1D43F
$cq, xrefs: 06A1D453
$cq, xrefs: 06A1D447

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq
API String ID: 0-2085107096
Opcode ID: af2ca425399e04ee7cb877620e88a26ad41b932436d9dc8c62dfc778553e9bd2
Instruction ID: 7c87a49bcd85a41e975c5fa69c512dcacc33fa40fc128c9071c6cef2124eacdb
Opcode Fuzzy Hash: af2ca425399e04ee7cb877620e88a26ad41b932436d9dc8c62dfc778553e9bd2
Instruction Fuzzy Hash: D6622C31A102068FCB55EF68D990A5EB7B3FF84304B608A68E4469F359DB75FD46CB80

Function 06A14840 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fhq, xrefs: 06A1486B
XPhq, xrefs: 06A14991
\Ohq, xrefs: 06A14A1B

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: fhq$XPhq$\Ohq
API String ID: 0-1165799323
Opcode ID: 4a878bbe289be53eeb6286e41f91428cdfeb52c7a608ab1d73f7668f159ca071
Instruction ID: b4113d3c0d21f4417b6441faf83d54a9887ece6c50b573f795833e5d8050ed91
Opcode Fuzzy Hash: 4a878bbe289be53eeb6286e41f91428cdfeb52c7a608ab1d73f7668f159ca071
Instruction Fuzzy Hash: CD615170F002199FDB54AFA9C8147AEBAF6FF88700F20842AD106AB395DB758C058F95

Function 06A19230 Relevance: 2.7, Strings: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 06A192C2
$cq, xrefs: 06A19287

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq
API String ID: 0-2695052418
Opcode ID: 1e900143dea0123559c600ff73949cbee3150491cedbaa545ccea186aa3c1d26
Instruction ID: 2aa2c27da2d638eb8d031459f34ad8caf2a80da7ff8271e49182cb3f07870d5c
Opcode Fuzzy Hash: 1e900143dea0123559c600ff73949cbee3150491cedbaa545ccea186aa3c1d26
Instruction Fuzzy Hash: 0D516131F105069FDB55EB78D960BAF77F6AF88600F148569D80ADF388EA309C02CB91

Function 06A14830 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fhq, xrefs: 06A1486B
XPhq, xrefs: 06A14991

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: fhq$XPhq
API String ID: 0-3594109931
Opcode ID: 35c421e48382af517c0564ecef625d18b4631549418de6d7961414dee037e4f1
Instruction ID: 571d36613ef08a810b3d3c0f806878d711c258e1efcb349148f2be5a3dab7c57
Opcode Fuzzy Hash: 35c421e48382af517c0564ecef625d18b4631549418de6d7961414dee037e4f1
Instruction Fuzzy Hash: 54516F70F002199FDB55AFA9C814BAEBAF7EF88700F208529D106AF395DE709C058F91

Function 069BC1F0 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4602953528.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69b0000_SOA Payment for June 30th.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 452bac6f5835fb19cb598c3ed0d0ea925b730fadf5111e3fe0c19c046440ee11
Instruction ID: aea3011b6a0081741a5f6a45d63fa7c750c2c6d895c146c88a8dcd2ad40c6b10
Opcode Fuzzy Hash: 452bac6f5835fb19cb598c3ed0d0ea925b730fadf5111e3fe0c19c046440ee11
Instruction Fuzzy Hash: 76716470A00B05CFDBA4DF6AD54479ABBF6FF88300F109929D48AD7A40DB74E846CB91

Function 069BE370 Relevance: 1.7, APIs: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069BE4E2

Memory Dump Source

Source File: 00000003.00000002.4602953528.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69b0000_SOA Payment for June 30th.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dbdb01f6eea2eca75fdaf6229cee9f4bbbc8b36d68a86791f199f996ffec4249
Instruction ID: 14534c5484c516c78420834794621bed45103729ff1682ed7499ebc45359f32d
Opcode Fuzzy Hash: dbdb01f6eea2eca75fdaf6229cee9f4bbbc8b36d68a86791f199f996ffec4249
Instruction Fuzzy Hash: B86114B1C04349AFCF11CF99C980ADEBFBABF49350F24815AE918AB221D7719845CF91

Function 02BBF161 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4599135742.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bb0000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a94aee1e36144dd81013628ecb0fa88482bb8d23420a8476b47a35a8f93a241
Instruction ID: 8f6749270c776e9a26a1fae483a980e67f4820987017999dc1f234192d9f452a
Opcode Fuzzy Hash: 5a94aee1e36144dd81013628ecb0fa88482bb8d23420a8476b47a35a8f93a241
Instruction Fuzzy Hash: C3412472E0434A8FCB04DF69D8046EEBBF5AF89310F1585AAE404E7741DB749841CBE1

Function 069BE3D0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 069BE4E2

Memory Dump Source

Source File: 00000003.00000002.4602953528.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69b0000_SOA Payment for June 30th.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: da11b3f6ff26466c85dfa6e93c9ae98c995bc483941be53cf06ba52cbe634a0d
Instruction ID: 6549599aaab3262c984f9828f5677ef9695f2a7a0a3f70c9637140c5c375b35a
Opcode Fuzzy Hash: da11b3f6ff26466c85dfa6e93c9ae98c995bc483941be53cf06ba52cbe634a0d
Instruction Fuzzy Hash: 9A41CFB1D003099FDF14CF99C984ADEBBF6BF48310F24852AE819AB210D7B4A845CF90

Function 02BB70A9 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02BB7127

Memory Dump Source

Source File: 00000003.00000002.4599135742.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bb0000_SOA Payment for June 30th.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 8947beb6db962fc7197b9294ab9a2c33d00723471e5cd20f581516d376bfe485
Instruction ID: f92d2374ffacb1e75f52d1cbad8533c7a759f8b621fda3dbcf8156d8c5eec666
Opcode Fuzzy Hash: 8947beb6db962fc7197b9294ab9a2c33d00723471e5cd20f581516d376bfe485
Instruction Fuzzy Hash: 7C2155B2C002598FCB00CF9AD985BEEFBF4AF49310F14846AE459A3250C778A944CFA1

Function 069B3EE0 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 069B3F6F

Memory Dump Source

Source File: 00000003.00000002.4602953528.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69b0000_SOA Payment for June 30th.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 70642bcb00066b479dc273c38a210a1ad80bc9c555b6f364e1985fdb7d3eaec7
Instruction ID: 2fe6e6fdbb9ebac1dfbb7486a39890ae5c9c71a200b5ac23a82c148fdb66cd4e
Opcode Fuzzy Hash: 70642bcb00066b479dc273c38a210a1ad80bc9c555b6f364e1985fdb7d3eaec7
Instruction Fuzzy Hash: 5E21E5B5D002099FDB10CF99D985ADEBFF9FB48314F14805AE918A3310D378A954DFA1

Function 069B00E0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 069B0163

Memory Dump Source

Source File: 00000003.00000002.4602953528.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69b0000_SOA Payment for June 30th.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 754688de59eaaae927fda584f4e0c194c298119f8fa99840feff522a9e2ecd7e
Instruction ID: ba6e66c552867fff0985220601600a2bffec5e0bc734180e92b6021ed762063d
Opcode Fuzzy Hash: 754688de59eaaae927fda584f4e0c194c298119f8fa99840feff522a9e2ecd7e
Instruction Fuzzy Hash: 9C2134B5D002099FCB14CFAAC948BDFFBF9EB88314F14842AE419A7250C774A945CFA1

Function 069B3EE8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 069B3F6F

Memory Dump Source

Source File: 00000003.00000002.4602953528.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69b0000_SOA Payment for June 30th.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5285897d3c56d234b07ec4cbd9512ed10abf7c414f656452af8b747875cf0489
Instruction ID: 8741210aae43b149be7b0234826900d3bd40ccb0d1ce8fc4b5261349a879c1ec
Opcode Fuzzy Hash: 5285897d3c56d234b07ec4cbd9512ed10abf7c414f656452af8b747875cf0489
Instruction Fuzzy Hash: E421E2B5D002099FDB10CFAAD984ADEBFF8FB48310F14801AE918A3310D378A944CFA1

Function 069BC640 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 069BC6B2

Memory Dump Source

Source File: 00000003.00000002.4602953528.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69b0000_SOA Payment for June 30th.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 76f2a513d6fbf004741096f149f763d010d61cd4b46bd2435ce811149d80e3ff
Instruction ID: 8f66f4418c9b7128cf4c69415c72479958d6cf26bbda467af4c421c27ec95098
Opcode Fuzzy Hash: 76f2a513d6fbf004741096f149f763d010d61cd4b46bd2435ce811149d80e3ff
Instruction Fuzzy Hash: FD1103B6C00349DFDB10CF9AD944ADEFBF9AB88310F10942AD519A7700C375A545CFA5

Function 069B00E8 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 069B0163

Memory Dump Source

Source File: 00000003.00000002.4602953528.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69b0000_SOA Payment for June 30th.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 964def845b23412a65d3de67d8a53cf530a5c29c20789339a59d7f5ec452a670
Instruction ID: 341f36186d55f824c7ea18707ad56fda3e29e8cdf4afe2d800560cea299e61b6
Opcode Fuzzy Hash: 964def845b23412a65d3de67d8a53cf530a5c29c20789339a59d7f5ec452a670
Instruction Fuzzy Hash: 752113B1D002099FCB14CF9AC944BEEFBF5AB88314F14842AD419A7250C774A944CFA1

Function 02BBF248 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02BBF2AF

Memory Dump Source

Source File: 00000003.00000002.4599135742.0000000002BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2bb0000_SOA Payment for June 30th.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 973f620b06400591c6168715c7deaf2393a93391c3c75e31c8a88c884ab1ab4d
Instruction ID: be59ab70eb502a7eda989270ca80c026f727ce7ebe8bfc3ebddf07e6a018bd86
Opcode Fuzzy Hash: 973f620b06400591c6168715c7deaf2393a93391c3c75e31c8a88c884ab1ab4d
Instruction Fuzzy Hash: 6E11E7B1C006599BCB10DF9AC5457EEFBF4AF48314F15816AE818A7740D378A944CFE5

Function 069BC648 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 069BC6B2

Memory Dump Source

Source File: 00000003.00000002.4602953528.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69b0000_SOA Payment for June 30th.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d0abd55d8da8ce3b3be779ff1a4bfd71e4483a02fac02776694034460f5a96cb
Instruction ID: 028cd1a1f1a79dc3f7d4a3168ad0e2551f76f8c46d19b475e40733b8019d2efb
Opcode Fuzzy Hash: d0abd55d8da8ce3b3be779ff1a4bfd71e4483a02fac02776694034460f5a96cb
Instruction Fuzzy Hash: 6F11E2B6D00349DFDB10CF9AD948AEEFBF8AB88310F10842AD419A7700C375A545CFA5

Function 069BB584 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,069BC20C), ref: 069BC446

Memory Dump Source

Source File: 00000003.00000002.4602953528.00000000069B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69b0000_SOA Payment for June 30th.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 687f0741f6cd589ce75db3dc19fddd3ba2ec1f1c05adca05e2049199875cdcd7
Instruction ID: 742a1cd0ea41376c9b6d7b74c30df398de999e31b636424531a0021641cb4008
Opcode Fuzzy Hash: 687f0741f6cd589ce75db3dc19fddd3ba2ec1f1c05adca05e2049199875cdcd7
Instruction Fuzzy Hash: 6B11F0B6C00249CFCB10DF9AD544AEEFBF9EB88214F10846AD859A7610D375A945CFA1

Function 07052360 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0705320D

Memory Dump Source

Source File: 00000003.00000002.4603512837.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7050000_SOA Payment for June 30th.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a54efec6f504c511a550e8e08d90fd79dc38c08ccb6e0b196404fa4d251af77d
Instruction ID: 7d8490c0359aebc7dd0796c5041379a281cb1ff96a3985f9e94d6edb3daf48c8
Opcode Fuzzy Hash: a54efec6f504c511a550e8e08d90fd79dc38c08ccb6e0b196404fa4d251af77d
Instruction Fuzzy Hash: 0B1103B5D047499FCB20DF9AD449B9EFBF4EB48314F108459D919A7300D374A944CFA5

Function 070531B0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0705320D

Memory Dump Source

Source File: 00000003.00000002.4603512837.0000000007050000.00000040.00000800.00020000.00000000.sdmp, Offset: 07050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7050000_SOA Payment for June 30th.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c6336a693b3b5cd20c6219c578a80da28147beea47cc06ad568703e2fed4627b
Instruction ID: db2d1d2fac0cfec4d5f995734fb9e2a66f8a02f0b0edd535d2f60ce18253bc15
Opcode Fuzzy Hash: c6336a693b3b5cd20c6219c578a80da28147beea47cc06ad568703e2fed4627b
Instruction Fuzzy Hash: E81112B5D002498FCB10DF9AD489BCEFBF4EB48324F20845AE529A7300C378A944CFA1

Function 06A1DBBD Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PHcq, xrefs: 06A1DD19

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: PHcq
API String ID: 0-4245845256
Opcode ID: 52c2917fb67f3bd5036a25b3c3c6e32fead5abdaa64b94769f392fe8f2f39dd4
Instruction ID: 1a4bdd043479007c0a6341d4e5caf3861ecdd3905d65a5edf7926335d82bfa9a
Opcode Fuzzy Hash: 52c2917fb67f3bd5036a25b3c3c6e32fead5abdaa64b94769f392fe8f2f39dd4
Instruction Fuzzy Hash: 3F417E70E0020A9FDB54EFB5C95469EBBB2FF85300F204929E506EF284DB74E946CB91

Function 06A121D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHcq, xrefs: 06A1230B

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: PHcq
API String ID: 0-4245845256
Opcode ID: d07a507d919c4877f547f68e045d4b2a403efb4385ba1a34aea1828745a216cf
Instruction ID: a110b5a8785ee32ff7adec66d29782b2ca83c48200171cd4b21c770774d2d10b
Opcode Fuzzy Hash: d07a507d919c4877f547f68e045d4b2a403efb4385ba1a34aea1828745a216cf
Instruction Fuzzy Hash: 3931FE31B002068FDB59ABB4C51476F7BA7AF88300B644868D40ADF385DE39DE86CB91

Function 06A14729 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ohq, xrefs: 06A14735

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: \Ohq
API String ID: 0-1367279102
Opcode ID: e81c3a15bedafdf48650f4781524cd23cd1fd24e53f61055ee0b54a7084a63b7
Instruction ID: 358ff8ced1bd35de870c00836ee1e9abd2782016ae25cf4249937ad49f595eec
Opcode Fuzzy Hash: e81c3a15bedafdf48650f4781524cd23cd1fd24e53f61055ee0b54a7084a63b7
Instruction Fuzzy Hash: BEF0B730A50129DFDB54AF94E859BADBBB2FF88711F20052AE402AB294CB745C41CBC0

Function 06A12BB2 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d14228cbc06b6f5f72ae9c1dd5f580c0c5de9067037ef6168a94b9e3976ae3a
Instruction ID: 3d2e93690c218b2c5cbb6fd4b1f042a82687f81a7657e62074ee555baec46190
Opcode Fuzzy Hash: 8d14228cbc06b6f5f72ae9c1dd5f580c0c5de9067037ef6168a94b9e3976ae3a
Instruction Fuzzy Hash: 13125434A002048FCB64EF68C584A99BBF2EF85314F55C4A9D44AAF365DB35ED85CF90

Function 06A16E00 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7db4ff41a199d00520fdfd9188aaa8d1ed7fc34f5de48d0cc0d2f8e56bf0691e
Instruction ID: d6d6de4e8d7fbfe7026738a1df5404d897fe9d8ffc14d98756127a73fd42f090
Opcode Fuzzy Hash: 7db4ff41a199d00520fdfd9188aaa8d1ed7fc34f5de48d0cc0d2f8e56bf0691e
Instruction Fuzzy Hash: 27A18931A002158FCB64EB68D554AADB7F3EF84314F659468E81AAF3A0DB35EC41CF90

Function 06A15ED0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62025f4abb3cdf201e4bd77951b2ffeaace24ded422ee0e0b84872ece711534
Instruction ID: d81494871fdc82c011ff9e44b6f34a32d69a2ea5f4af879703db87727824d064
Opcode Fuzzy Hash: b62025f4abb3cdf201e4bd77951b2ffeaace24ded422ee0e0b84872ece711534
Instruction Fuzzy Hash: 7B61A3B1F101124FCB55AB6EC84466FAAE7AFC4220B254439E80EDF364EE75DD0287D1

Function 06A14294 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8eba932da709edf578660dd935098f0bd66145792be02f297cc8f0909fd962e
Instruction ID: 6cf9b9c8cdcecfe594076612ea165d76c9c14342377988d3f827c70690548825
Opcode Fuzzy Hash: a8eba932da709edf578660dd935098f0bd66145792be02f297cc8f0909fd962e
Instruction Fuzzy Hash: 70915E74E006198BDF60DF68C880B9DB7B2FF89310F208599E449AB295DB70AD85CF91

Function 06A13F79 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb7aa5913581b0d8afcb32475a969696d2f2dc23eff6639114cc782cd6bfeb4
Instruction ID: b4933c127391c548649248fda6b120f356bbc1dd2b0422555a040947c22056e9
Opcode Fuzzy Hash: 4bb7aa5913581b0d8afcb32475a969696d2f2dc23eff6639114cc782cd6bfeb4
Instruction Fuzzy Hash: 10813D31B102068BDF54EFA9D55476EBBF6EF88300F248429D80ADF399EA34DC428B51

Function 06A1B010 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc523c4b8440dab0446a0698cef7c09d0d2a1dc2284b40e621baf7fd5e2bc053
Instruction ID: ed5585c11a6ccfdd6db38f69f491b5640dea07a41671da689641f8adec5e0e51
Opcode Fuzzy Hash: fc523c4b8440dab0446a0698cef7c09d0d2a1dc2284b40e621baf7fd5e2bc053
Instruction Fuzzy Hash: F7716031F0031A8FCF55EFA5D5406AEB7B2FF85300F608529E806AF358DB74A8468B90

Function 06A142A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939d4f1f2ca7f46ae4d4f7d23bd1d7aa2315b48631bd237a5f03a8233fcbe83a
Instruction ID: 446e428edd5469c966f21692e9c5e0db412268b328b671cb0cbffb8876af9347
Opcode Fuzzy Hash: 939d4f1f2ca7f46ae4d4f7d23bd1d7aa2315b48631bd237a5f03a8233fcbe83a
Instruction Fuzzy Hash: A1914E74E106198BDF60DF68C880B9DB7B1FF89310F208599D549BB295EB70AE85CF90

Function 06A1EC0F Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a952c444dfef1e96d986d0acb2681a9e68e8c2c5d7e963c3eeba58d839f4c747
Instruction ID: 9873333a3a8b0a54dd39ee39b64d6fbd4b63039ecf59eb0fd539fae9e9e282a7
Opcode Fuzzy Hash: a952c444dfef1e96d986d0acb2681a9e68e8c2c5d7e963c3eeba58d839f4c747
Instruction Fuzzy Hash: 02713F71E002099FCB54EFA9D990A9DBBF6FF88300F648569E406EB354DB30E946CB51

Function 06A1EC20 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294c1b8ff70c8d20048bf22bd99ee6aa9f55dec3dded2e777e647f5f37680cb5
Instruction ID: e9f1b262e43dca4e36bb6d785cd7a27cdad6ba9f28e121683f3fa5410efbc823
Opcode Fuzzy Hash: 294c1b8ff70c8d20048bf22bd99ee6aa9f55dec3dded2e777e647f5f37680cb5
Instruction Fuzzy Hash: EA712C71E002099FDB54EBA9C990AADBBF6FF88300F648469E405EB354DB30E946CB51

Function 06A1FD78 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 219de97d884af9108f2f2362d8389f30c51014fa1d7d96537930d95b42a239cc
Instruction ID: e6649263588e6eee5352dd785b8ad27115a77c68fa409d633d5852b61f6c08b9
Opcode Fuzzy Hash: 219de97d884af9108f2f2362d8389f30c51014fa1d7d96537930d95b42a239cc
Instruction Fuzzy Hash: BF51FF32E001459FCB54BBB8E8486ADBBF2EF85315F108869E10ADF290DF359956CB81

Function 06A1F729 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde330d8e151bf66a6de109e40bf22131b2c02d3d7d9fe1a7aa50d224e0445f7
Instruction ID: 828fa9fed47c21e527028b45d2594b5081a501a8045e48010aa70f196222d051
Opcode Fuzzy Hash: dde330d8e151bf66a6de109e40bf22131b2c02d3d7d9fe1a7aa50d224e0445f7
Instruction Fuzzy Hash: 6551D575B201555FEF607B6CD8A477E269AEB8D310F20443AD10ACF399CB39DC518792

Function 06A1F738 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6419ad84290738da3ff1715cb70baf94685b0e69b6f76d1f307003fa3c10617
Instruction ID: b4ec059607e08c1ab51ca8744b7265712483f32cedc0d34ab0c16ba5292c5977
Opcode Fuzzy Hash: a6419ad84290738da3ff1715cb70baf94685b0e69b6f76d1f307003fa3c10617
Instruction Fuzzy Hash: A051C174B201555FEF607B6CD8A473F269AEB8D310F20442AE10ACF398CB79DC5187A2

Function 06A150E9 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 748f03e8af8c70d305e0a877a337c2a7787ac3295226ecda95f4c49f5462e736
Instruction ID: 7ff10b8e9ec5b96c0fd846783ffe380d9cb22b7deb5d8c54296a3bb8c58600cb
Opcode Fuzzy Hash: 748f03e8af8c70d305e0a877a337c2a7787ac3295226ecda95f4c49f5462e736
Instruction Fuzzy Hash: 1A4164B1E006099FDF71EFA9D8816AFF7B6FB94310F10492AD155DB640D731A8458B90

Function 06A1DA70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3137711406b0f04f03423464ceec047cce724169a9aab3f045273b737b4d7a3e
Instruction ID: f990506971e0e7370e5cf9419f125eb35b8e6753fa1120f6e89f52440f3ef547
Opcode Fuzzy Hash: 3137711406b0f04f03423464ceec047cce724169a9aab3f045273b737b4d7a3e
Instruction Fuzzy Hash: 2831B670E1430A9BCF15EF69D98069EB7B6EF85314F244929E406EF354EB70A942CB80

Function 06A12080 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd2e63d5fa6e9840d4646fa1c110d79233cfce129a038f3565fcc24efd7cac2
Instruction ID: b8cc59c56ed9dbf4059218eb11697fc943f28af4b67586f9d4a6238077440346
Opcode Fuzzy Hash: 5fd2e63d5fa6e9840d4646fa1c110d79233cfce129a038f3565fcc24efd7cac2
Instruction Fuzzy Hash: 79318D71E102099BDB48DF64D994B9EF7B2BF89300F108529E906EB754DB71ED82CB90

Function 06A12090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb24dc7cdc0f36990f97f6eb5f42067abf56c99bac5680c2d869af97f1f870f
Instruction ID: b42042c40503d469c087202b97f5e461ca53a925d3872b4ebec11670ef6ad2a1
Opcode Fuzzy Hash: ddb24dc7cdc0f36990f97f6eb5f42067abf56c99bac5680c2d869af97f1f870f
Instruction Fuzzy Hash: 99318E30E102099BDB48DF64D854B9EF7B6BF89300F108529E906EB754DB71ED82CB50

Function 06A13B81 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dadca239b093226fd82a8c762bca97bcab8d5602da7b8377fd938adfd981f13
Instruction ID: 2662deac7273af68e5a6acfd76ea3270db91bb4e2baef583a1253c509f78959b
Opcode Fuzzy Hash: 4dadca239b093226fd82a8c762bca97bcab8d5602da7b8377fd938adfd981f13
Instruction Fuzzy Hash: A221BF71F00216AFDB50EF79D980AEEBBF6EB48710F004429E805EB355E730E9018BA0

Function 06A13B90 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e44408f5b414456bec2cba291481264da0a9e0b37cbc07ba5cacc9dc02fa075
Instruction ID: cbdf975531cdc5e8eff5152d324a61fbd3f35e944b83760a555823d5fc793c67
Opcode Fuzzy Hash: 9e44408f5b414456bec2cba291481264da0a9e0b37cbc07ba5cacc9dc02fa075
Instruction Fuzzy Hash: D9219075F006169FDF50EFA9D980AAEBBF1EB48710F108069E905EB354E730E9018F90

Function 06A16DF1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9812fd153b92194ae7fbdebd3f324ae2689b3233526bf681e91f79d62c01966d
Instruction ID: 95a6af871b818a7f6b3d61cf96589b29e59855992ff079636f1b431556be1171
Opcode Fuzzy Hash: 9812fd153b92194ae7fbdebd3f324ae2689b3233526bf681e91f79d62c01966d
Instruction Fuzzy Hash: 9A21CF31B110099FDF44EB69E9546AEBBB7EB85310F248429E809DF391DA30DD428B90

Function 02AED110 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4598477138.0000000002AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aed000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872e093eaff8b7d2883bbfe9988ad234881c9f2b97582b02da7ffc49fb7a801d
Instruction ID: 47e0be5e10a95216e165348b5c1bed57920e1d81d709bbf4361fc8d43dfd6262
Opcode Fuzzy Hash: 872e093eaff8b7d2883bbfe9988ad234881c9f2b97582b02da7ffc49fb7a801d
Instruction Fuzzy Hash: A62104B5604604EFDF04DF14D9C0B26BBA9FB88314F24C56DE80B4B246CB36D44BCA61

Function 06A13ED8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e931bdd61caa0a8617bf364ce8fca93f2a4a4bd2dd223a38fc22b4b33b753f4
Instruction ID: f876c35347e6ca6178aa4c5e2c7c09ac06850cc1a4559d3901db5d2e75ed847f
Opcode Fuzzy Hash: 4e931bdd61caa0a8617bf364ce8fca93f2a4a4bd2dd223a38fc22b4b33b753f4
Instruction Fuzzy Hash: 7A01BC71B101101BDF60AA6DA811BABB7EFDBC9720F248839F50BCF785DA65DC424391

Function 06A16518 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4d552a3036376e41be5328891184bec5a5ee082702814580d2bdaf66e5f600
Instruction ID: e8287a329f2542fcb045972f5eeabf47ed0cecd29821b66e2d446ca6430fbdb1
Opcode Fuzzy Hash: 1f4d552a3036376e41be5328891184bec5a5ee082702814580d2bdaf66e5f600
Instruction Fuzzy Hash: 7A115E6191E3E16FCB13AB384C645D63F699F43214F1905D3E884CF193D1258A18C3E6

Function 06A13CA0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 905f716a53eb57a28789afbe2088adc4716bb85bca9198a7930751e0ccff9c1e
Instruction ID: 3d8071ba5f6af980e29f45e31cb751faf3c2c4bf60c33b8b850b8b8bf3feb1ac
Opcode Fuzzy Hash: 905f716a53eb57a28789afbe2088adc4716bb85bca9198a7930751e0ccff9c1e
Instruction Fuzzy Hash: A611A136B141254FDF54AA78D9146AE73FAEBC9610F048439D90AEF358EE24DC068BD1

Function 06A13958 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29df869f10a24804112bf170858749459d58d5182705e35ba4145b518ac74403
Instruction ID: 3a7f87285d2429db0afd290d01ed5a40f4f289aca9c18c6e74c0d85e0f5d19cc
Opcode Fuzzy Hash: 29df869f10a24804112bf170858749459d58d5182705e35ba4145b518ac74403
Instruction Fuzzy Hash: 4821E0B5D01259AFCB00DF9AD885ACEFFB9FB48310F10816AE918A7300C374A954CBA5

Function 06A13C91 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf0542228e85211648eb2df0da8aa7c139f83e30d965b5c0d75e3f5dee5cec0
Instruction ID: cc6e1a96450b348fb9a14ee1d688e92aea896170210af7e5b2b5c9f0d9e36967
Opcode Fuzzy Hash: dcf0542228e85211648eb2df0da8aa7c139f83e30d965b5c0d75e3f5dee5cec0
Instruction Fuzzy Hash: CD01D832B141251BEF55AA79DC146EF7BFBDBC9310F044439D546DB344EE20980647E1

Function 06A1EE8F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbdef7e52126e629e605b76d529461363166b37125db97b8da0633eb2c91da98
Instruction ID: 906f4ee5165b91d90e99490141783199339c7450eb7f1787b4bc7e31fc11da6f
Opcode Fuzzy Hash: cbdef7e52126e629e605b76d529461363166b37125db97b8da0633eb2c91da98
Instruction Fuzzy Hash: F3018F72B105155BDB65A73CA45076A27DBEBCA720F208839F90BCF784DA25DC034796

Function 02AED10B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4598477138.0000000002AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2aed000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction ID: 7425e40878fe8b59cea3dc8cb947c8f93c66a5ca3b26ed844f3c663c08641cdd
Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction Fuzzy Hash: C011DD75504680CFCB05CF10D9C4B15BBB2FB88318F24C6AADC4A4B696C33AD44BCB61

Function 06A1A3F2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58fb5bc657927c79ed8ac94282dfe6d2d9e06f93cd287c850d433803a47e9dda
Instruction ID: e5b0b4a4da083680a88efca03aeaee918798758822c0e2d41e8731f039008f74
Opcode Fuzzy Hash: 58fb5bc657927c79ed8ac94282dfe6d2d9e06f93cd287c850d433803a47e9dda
Instruction Fuzzy Hash: 28012F31B221510FDB51A738A85472A7BEAEB86320F20886AE24BCF755DE20DD028380

Function 06A13960 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ffc7546b4183d96cb615a8093a7a8f22773d5a37f93a9cfc04e734a922f712
Instruction ID: 52ee7c294035d8596b4f048ecdff0906a27fabab175896615fd7c323dfc14b10
Opcode Fuzzy Hash: f8ffc7546b4183d96cb615a8093a7a8f22773d5a37f93a9cfc04e734a922f712
Instruction Fuzzy Hash: 9011DDB1D01259AFCB00DF9AD885ADEFFB8FB48310F10812AE918A7300C374A954CFA5

Function 06A13EE8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f7dbe3f9805ae33737a99b45a4e2d1b7d1f4b931bc01d4ce8f3bd4a2a1c0b0
Instruction ID: f83bdacc42274542e1cff03cd2e98f548af5dd0a50abb90892930273dfdcfe10
Opcode Fuzzy Hash: 45f7dbe3f9805ae33737a99b45a4e2d1b7d1f4b931bc01d4ce8f3bd4a2a1c0b0
Instruction Fuzzy Hash: 56016971B101105BDF64AA6EA41172BB2EBDBC9B20F20883AF50BCF784DE65DC424791

Function 06A1EEA0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1385c8128353c4a192221b3638f658f2f30ae446d13786a1558e04218ec6648f
Instruction ID: b62254b454f78b510ee20fb4442f3d7a5db443df8a91fe49ffcc2ecec61427dd
Opcode Fuzzy Hash: 1385c8128353c4a192221b3638f658f2f30ae446d13786a1558e04218ec6648f
Instruction Fuzzy Hash: 4B01AF71B101155BDB64A77CA45072E72DBEBCA720F208839F90BCF384DE25EC024795

Function 06A1A400 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7976cf8211cd535a9c1100296dcf650d3ffba5c19be109508b7b438b0bc217
Instruction ID: a768f6ab3e8868ee5ee60c605b53146713c84efa1c2ebcd92fb2bffe10f5a08e
Opcode Fuzzy Hash: 9f7976cf8211cd535a9c1100296dcf650d3ffba5c19be109508b7b438b0bc217
Instruction Fuzzy Hash: 16018171B215114BDB54FB7CE45472A77DAEB85710F108429E60BCF754DE21ED028780

Non-executed Functions

Function 06A17788 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A17C85
$cq, xrefs: 06A178F9
$cq, xrefs: 06A17D24
$cq, xrefs: 06A17D2E
$cq, xrefs: 06A17D3A
$cq, xrefs: 06A17D18
$cq, xrefs: 06A178ED
$cq, xrefs: 06A17C79
$cq, xrefs: 06A178BC
$cq, xrefs: 06A178C8

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq$$cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-539408830
Opcode ID: 5e7ca2870a23c9c0d920b92dd52aaee1a3574ee7b1ddf0c3e255859bb7a8b8fe
Instruction ID: 89d81adff3d0be4ad21b49654e708981c56b9b20815e8665dec5eb63b45cf559
Opcode Fuzzy Hash: 5e7ca2870a23c9c0d920b92dd52aaee1a3574ee7b1ddf0c3e255859bb7a8b8fe
Instruction Fuzzy Hash: 8D120C34E0021A8FDB65EF65D954AAEB7F2BF89300F2095A9D406AB355DB30DD85CF80

Function 06A1AA28 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A1AB1E
$cq, xrefs: 06A1ABA4
$cq, xrefs: 06A1AB2A
$cq, xrefs: 06A1AB85
$cq, xrefs: 06A1ABB0
$cq, xrefs: 06A1AB79
$cq, xrefs: 06A1ABE6
$cq, xrefs: 06A1ABDA

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-3377385791
Opcode ID: fdc82da1ea58b88b9530a6b16c67b5ccba95eedbd00367510cd8c0d3555e799c
Instruction ID: 669ca46cb89096cb9e3911e9a19d95c468ab8e0d0a157ffb9079929ca623efc7
Opcode Fuzzy Hash: fdc82da1ea58b88b9530a6b16c67b5ccba95eedbd00367510cd8c0d3555e799c
Instruction Fuzzy Hash: 54917C70E022099FDB64FBA5D9547AEBBF2AF84300F208429E9069F395DB749C45CB90

Function 06A17188 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A17624
.5{q, xrefs: 06A171E3
$cq, xrefs: 06A1746A
$cq, xrefs: 06A174C4
$cq, xrefs: 06A17690
$cq, xrefs: 06A174D0
$cq, xrefs: 06A1769C

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: .5{q$$cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-986819311
Opcode ID: 09045df8ca950f701448cdd4d8882050e1a2f44949348397a5ae1669317005db
Instruction ID: 76981ec47fc202b0ecaf99b03ea3f6a558cba171232fd6b05219dc2abbabd5a4
Opcode Fuzzy Hash: 09045df8ca950f701448cdd4d8882050e1a2f44949348397a5ae1669317005db
Instruction Fuzzy Hash: 4DF12934A102098FDB59FBA4D554A6EBBB3BF88300F648469D4159F398DB35EC82CF80

Function 06A184C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$cq, xrefs: 06A1877F
$cq, xrefs: 06A1871A
$cq, xrefs: 06A1878B
$cq, xrefs: 06A18726

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: b7b4e01585a485b31f6240e9819ed042fd96b2d6019e619c3f365525c6c5efe3
Instruction ID: 6102a9405ea54661a3ba6489b67bef6d8956e02e4b797e0f692f73f3220014e0
Opcode Fuzzy Hash: b7b4e01585a485b31f6240e9819ed042fd96b2d6019e619c3f365525c6c5efe3
Instruction Fuzzy Hash: B0B12A70E112198FDB65EF69C5506AEBBB3EF84300F248469D4069F394DB79DC86CB81

Function 06A188D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRcq, xrefs: 06A189CB
$cq, xrefs: 06A18957
$cq, xrefs: 06A18963
LRcq, xrefs: 06A18A1A

Memory Dump Source

Source File: 00000003.00000002.4603078148.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a10000_SOA Payment for June 30th.jbxd

Similarity

API ID:
String ID: LRcq$LRcq$$cq$$cq
API String ID: 0-2876661331
Opcode ID: 85a459506648cb2eddf4e4cab3104960925d6f64e3d01e1ea87f8b593039cebb
Instruction ID: b5be920df0fb043e6b46fca05d8fcd8035be3e8ccbdc2b1efe9aa16723312b77
Opcode Fuzzy Hash: 85a459506648cb2eddf4e4cab3104960925d6f64e3d01e1ea87f8b593039cebb
Instruction Fuzzy Hash: 8B51A171B002028FDB54FB68D950A6AB7F6FF85300F25896DE4069F395DA35EC41CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SOA Payment for June 30th.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SOA Payment for June 30th.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
SOA Payment for June 30th.exe

Function 058B8B98 Relevance: 9.0, Strings: 7, Instructions: 280
COMMON

Function 058B869E Relevance: 5.4, Strings: 4, Instructions: 350
COMMON

Function 058B84D3 Relevance: 5.3, Strings: 4, Instructions: 349
COMMON

Function 058B8A08 Relevance: 5.3, Strings: 4, Instructions: 344
COMMON

Function 058B8859 Relevance: 5.3, Strings: 4, Instructions: 340
COMMON

Function 058B8487 Relevance: 5.3, Strings: 4, Instructions: 339
COMMON

Function 058B87F9 Relevance: 5.3, Strings: 4, Instructions: 336
COMMON

Function 058B8720 Relevance: 5.3, Strings: 4, Instructions: 334
COMMON

Function 058B8A9C Relevance: 5.3, Strings: 4, Instructions: 332
COMMON

Function 058B8850 Relevance: 5.3, Strings: 4, Instructions: 331
COMMON

Function 058B8762 Relevance: 5.3, Strings: 4, Instructions: 330
COMMON

Function 058B8638 Relevance: 5.3, Strings: 4, Instructions: 330
COMMON

Function 0133D271 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Function 0133D280 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre