Edit tour

Windows Analysis Report
UxTheme.dll.dll

Overview

General Information

Sample name:	UxTheme.dll.dll (renamed file extension from exe to dll)
Original sample name:	UxTheme.dll.exe
Analysis ID:	1468058
MD5:	336bed2506b03c75235a8549888e64b9
SHA1:	da0808fe16c9b3cf20a133d56343d45bf0faf8ea
SHA256:	d25d0df1669dc0f2c1eff862518b263fb3ced9e4ec2a150de6af06939dd9738e
Tags:	exe
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

PE file contains section with special chars

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Entry point lies outside standard sections

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 3868 cmdline: loaddll64.exe "C:\Users\user\Desktop\UxTheme.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 6700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7132 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 6376 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

regsvr32.exe (PID: 6472 cmdline: regsvr32.exe /s C:\Users\user\Desktop\UxTheme.dll.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

rundll32.exe (PID: 6536 cmdline: rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginBufferedAnimation MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4116 cmdline: rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginBufferedPaint MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 4348 cmdline: C:\Windows\system32\WerFault.exe -u -p 4116 -s 416 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 4812 cmdline: rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginPanningFeedback MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1280 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginBufferedAnimation MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4544 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginBufferedPaint MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6604 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginPanningFeedback MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6788 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",UpdateSignature MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3644 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",UpdatePanningFeedback MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6116 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",ThemeInitApiHook MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5216 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetWindowThemeAttribute MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6592 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetWindowTheme MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 788 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetThemeAppProperties MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6272 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeDataForDpi MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5340 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeDataEx MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5380 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeData MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2340 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemePartDefined MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2024 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeDialogTextureEnabled MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6596 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeBackgroundPartiallyTransparent MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4904 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeActive MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1352 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsCompositionActive MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6516 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsAppThemed MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5684 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",HitTestThemeBackground MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3920 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetWindowTheme MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3732 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetUserColorPreference MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6376 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTransitionDuration MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6916 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTimingFunction MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4512 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTextMetrics MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7116 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTextExtent MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 792 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysString MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1424 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysSize MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1652 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysInt MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6464 cmdline: rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysFont MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 60000, "MaxGetSize": 11456204, "Jitter": 51, "C2Server": "us-central1-keepass-415209.cloudfunctions.net,/keepasswork/api/v1/metadata/private", "HttpPostUri": "/keepasswork/api/v1/metadata/user/avatar", "Malleable_C2_Instructions": ["Remove 2 bytes from the end", "Remove 60 bytes from the beginning", "Base64 URL-safe decode", "XOR mask w/ random key", "NetBIOS decode 'a'"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\WerFault.exe -u -p 1324 -s 1528", "Spawnto_x64": "%windir%\\sysnative\\WerFault.exe -u -p 1324 -s 1528", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 628807914, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": "2024-03-31", "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 379133, "ProcInject_PrependAppend_x86": ["kJCQkJCQkJCQ", "kJCQkJCQkJCQ"], "ProcInject_PrependAppend_x64": ["kJCQkJCQkJCQ", "kJCQkJCQkJCQ"], "ProcInject_Execute": ["ntdll:RtlUserThreadStart", "CreateThread", "NtQueueApcThread-s", "NtQueueApcThread", "RtlCreateUserThread", "SetThreadContext", "CreateRemoteThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "True", "HostHeader": "Host: us-central1-keepass-415209.cloudfunctions.net\r\n"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000003.2777687515.00000256A6980000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000010.00000003.2777687515.00000256A6980000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000010.00000003.2777687515.00000256A6980000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1b934:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x24534:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000010.00000002.2786136846.00000256A8758000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2753368272.0000013678D70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2753368272.0000013678D70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2753368272.0000013678D70000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1b934:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000006.00000002.2658118414.0000014571670000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x24534:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000006.00000002.2658150493.00000145716A8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000010.00000002.2786000448.00000256A8720000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x24534:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000006.00000003.2657321127.0000014571620000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000006.00000003.2657321127.0000014571620000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000006.00000003.2657321127.0000014571620000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1b934:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2754647446.0000013678DF8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: loaddll64.exe PID: 3868	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 6376	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 6788	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
16.3.rundll32.exe.256a6980000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
16.3.rundll32.exe.256a6980000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
16.3.rundll32.exe.256a6980000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1ad34:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.3.loaddll64.exe.13678d70000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.3.loaddll64.exe.13678d70000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.3.loaddll64.exe.13678d70000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1ad34:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.3.loaddll64.exe.13678d70000.0.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.3.loaddll64.exe.13678d70000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.3.loaddll64.exe.13678d70000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1b934:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
6.3.rundll32.exe.14571620000.0.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
6.3.rundll32.exe.14571620000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
6.3.rundll32.exe.14571620000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1ad34:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
6.3.rundll32.exe.14571620000.0.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
6.3.rundll32.exe.14571620000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
6.3.rundll32.exe.14571620000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1b934:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
16.3.rundll32.exe.256a6980000.0.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
16.3.rundll32.exe.256a6980000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
16.3.rundll32.exe.256a6980000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1b934:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
Click to see the 13 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000010.00000003.2777687515.00000256A6980000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 60000, "MaxGetSize": 11456204, "Jitter": 51, "C2Server": "us-central1-keepass-415209.cloudfunctions.net,/keepasswork/api/v1/metadata/private", "HttpPostUri": "/keepasswork/api/v1/metadata/user/avatar", "Malleable_C2_Instructions": ["Remove 2 bytes from the end", "Remove 60 bytes from the beginning", "Base64 URL-safe decode", "XOR mask w/ random key", "NetBIOS decode 'a'"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\WerFault.exe -u -p 1324 -s 1528", "Spawnto_x64": "%windir%\\sysnative\\WerFault.exe -u -p 1324 -s 1528", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 628807914, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": "2024-03-31", "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 379133, "ProcInject_PrependAppend_x86": ["kJCQkJCQkJCQ", "kJCQkJCQkJCQ"], "ProcInject_PrependAppend_x64": ["kJCQkJCQkJCQ", "kJCQkJCQkJCQ"], "ProcInject_Execute": ["ntdll:RtlUserThreadStart", "CreateThread", "NtQueueApcThread-s", "NtQueueApcThread", "RtlCreateUserThread", "SetThreadContext", "CreateRemoteThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "True", "HostHeader": "Host: us-central1-keepass-415209.cloudfunctions.net\r\n"}

Multi AV Scanner detection for submitted file

Source: UxTheme.dll.dll	Virustotal: Detection: 37%			Perma Link
Source: UxTheme.dll.dll	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source:	Binary string: Z:\data\loaders\EvilProxyDll-master\EvilProxyDLL\x64\Release\EvilProxyDLL.pdb source: loaddll64.exe, 00000000.00000003.2720535139.0000013678900000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.2763457463.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000004.00000002.2632910459.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000004.00000003.2631971858.00000000009A0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2637825326.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000003.2631582760.000002ED45480000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2631492658.000001456FC70000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2658497704.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.2904790460.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000003.2660715337.0000020B67A00000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2695239468.000001F028900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.2700982334.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000003.2754046806.000001C9B9D90000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.2771474351.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000003.2751617374.000002C17C6E0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.2855868309.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2770781756.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000003.2755178403.0000018A21B00000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2786576454.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000003.2749029102.00000256A6940000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2754536935.0000024FEA5D0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.2763985665.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2770313057.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000003.2755418217.0000011C193F0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.2769167128.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000003.2754499454.0000021B3EE60000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000014.00000002.2765583596.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000003.2750128068.000001AB07A10000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2754033866.0000011319200
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: loaddll64.exe, 00000000.00000002.2768698425.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000004.00000002.2633003757.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2637983839.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2658617443.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.2904939987.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2701089699.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2773109484.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.2856013589.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2772478758.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2787040179.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2764459215.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2771861469.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2770124965.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2766130893.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2767828792.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2772321065.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2772170828.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2768439722.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.2768538647.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2776915066.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2772216438.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2773680469.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2758812796.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.2772704180.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.2773205781.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000020.00000002.2772158510.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.2873398411.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.2775937894.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.2761298877.00007FFB0C6EA000.00000040.00000001.0100000
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: loaddll64.exe, loaddll64.exe, 00000000.00000002.2768698425.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, regsvr32.exe, regsvr32.exe, 00000004.00000002.2633003757.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, rundll32.exe, 00000005.00000002.2637983839.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2658617443.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.2904939987.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2701089699.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2773109484.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.2856013589.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2772478758.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2787040179.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2764459215.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2771861469.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2770124965.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2766130893.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2767828792.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2772321065.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2772170828.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2768439722.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.2768538647.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2776915066.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2772216438.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2773680469.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2758812796.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.2772704180.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.2773205781.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000020.00000002.2772158510.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.2873398411.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.2775937894.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.2761298877.0

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: us-central1-keepass-415209.cloudfunctions.net

Source: Amcache.hve.10.dr

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 16.3.rundll32.exe.256a6980000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.3.loaddll64.exe.13678d70000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.3.loaddll64.exe.13678d70000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 6.3.rundll32.exe.14571620000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 6.3.rundll32.exe.14571620000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 16.3.rundll32.exe.256a6980000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000010.00000003.2777687515.00000256A6980000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000003.2753368272.0000013678D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000006.00000002.2658118414.0000014571670000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000010.00000002.2786000448.00000256A8720000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000006.00000003.2657321127.0000014571620000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown

PE file contains section with special chars

Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:

PE file has a writeable .text section

Source: UxTheme.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_00000136789100A0 NtAllocateVirtualMemory,NtAllocateVirtualMemory,		0_3_00000136789100A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DC7250 NtFreeVirtualMemory,		0_2_0000013678DC7250

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_000001367891712E	0_3_000001367891712E
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_0000013678914F41	0_3_0000013678914F41
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_3_00000136789112C0	0_3_00000136789112C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DDFB38	0_2_0000013678DDFB38
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DE9B80	0_2_0000013678DE9B80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DC4571	0_2_0000013678DC4571
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DF3E70	0_2_0000013678DF3E70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DE6D98	0_2_0000013678DE6D98
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DC675E	0_2_0000013678DC675E
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DF47E0	0_2_0000013678DF47E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DE9118	0_2_0000013678DE9118
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DC08F0	0_2_0000013678DC08F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DE8A54	0_2_0000013678DE8A54

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4116 -s 416

Source: UxTheme.dll.dll

Static PE information: Number of sections : 12 > 10

Source: UxTheme.dll.dll

Binary or memory string: OriginalFilenameUxTheme.dllj% vs UxTheme.dll.dll

Source: 16.3.rundll32.exe.256a6980000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.3.loaddll64.exe.13678d70000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.3.loaddll64.exe.13678d70000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 6.3.rundll32.exe.14571620000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 6.3.rundll32.exe.14571620000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 16.3.rundll32.exe.256a6980000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000010.00000003.2777687515.00000256A6980000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000003.2753368272.0000013678D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000006.00000002.2658118414.0000014571670000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000010.00000002.2786000448.00000256A8720000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000006.00000003.2657321127.0000014571620000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17

Source: UxTheme.dll.dll	Static PE information: Section: ZLIB complexity 0.9977936921296297
Source: UxTheme.dll.dll	Static PE information: Section: ZLIB complexity 0.9974365234375
Source: UxTheme.dll.dll	Static PE information: Section: ZLIB complexity 0.9931918806221889

Source: classification engine

Classification label: mal100.troj.evad.winDLL@76/5@0/0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6700:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4116

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\93a05f0a-522e-47d9-8c16-75fbe37a3a9b

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginBufferedAnimation

Source: UxTheme.dll.dll	Virustotal: Detection: 37%
Source: UxTheme.dll.dll	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\UxTheme.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\UxTheme.dll.dll
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginBufferedAnimation
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginBufferedPaint
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4116 -s 416
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginPanningFeedback
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginBufferedAnimation
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginBufferedPaint
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginPanningFeedback
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",UpdateSignature
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",UpdatePanningFeedback
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",ThemeInitApiHook
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetWindowThemeAttribute
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetWindowTheme
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetThemeAppProperties
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeDataForDpi
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeDataEx
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeData
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemePartDefined
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeDialogTextureEnabled
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeBackgroundPartiallyTransparent
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeActive
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsCompositionActive
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsAppThemed
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",HitTestThemeBackground
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetWindowTheme
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetUserColorPreference
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTimingFunction
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTextMetrics
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTextExtent
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysString
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysSize
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysInt
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysFont
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\UxTheme.dll.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginBufferedAnimation	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginBufferedPaint	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginPanningFeedback	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginBufferedAnimation	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginBufferedPaint	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginPanningFeedback	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",UpdateSignature	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",UpdatePanningFeedback	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",ThemeInitApiHook	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetWindowThemeAttribute	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetWindowTheme	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetThemeAppProperties	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeDataForDpi	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeDataEx	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeData	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemePartDefined	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeDialogTextureEnabled	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeBackgroundPartiallyTransparent	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeActive	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsCompositionActive	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsAppThemed	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",HitTestThemeBackground	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetWindowTheme	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetUserColorPreference	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTimingFunction	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTextMetrics	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTextExtent	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysString	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysSize	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysInt	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysFont	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: UxTheme.dll.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: UxTheme.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: UxTheme.dll.dll

Static file information: File size 3842048 > 1048576

Source: UxTheme.dll.dll

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x345c00

Source:	Binary string: Z:\data\loaders\EvilProxyDll-master\EvilProxyDLL\x64\Release\EvilProxyDLL.pdb source: loaddll64.exe, 00000000.00000003.2720535139.0000013678900000.00000004.00001000.00020000.00000000.sdmp, loaddll64.exe, 00000000.00000002.2763457463.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000004.00000002.2632910459.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000004.00000003.2631971858.00000000009A0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2637825326.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000003.2631582760.000002ED45480000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2631492658.000001456FC70000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2658497704.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.2904790460.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000003.2660715337.0000020B67A00000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000003.2695239468.000001F028900000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000C.00000002.2700982334.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000003.2754046806.000001C9B9D90000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000D.00000002.2771474351.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000003.2751617374.000002C17C6E0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000E.00000002.2855868309.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2770781756.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000003.2755178403.0000018A21B00000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2786576454.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000003.2749029102.00000256A6940000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000003.2754536935.0000024FEA5D0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000011.00000002.2763985665.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2770313057.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000003.2755418217.0000011C193F0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000013.00000002.2769167128.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000003.2754499454.0000021B3EE60000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000014.00000002.2765583596.00007FFB0C37E000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000003.2750128068.000001AB07A10000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2754033866.0000011319200
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: loaddll64.exe, 00000000.00000002.2768698425.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000004.00000002.2633003757.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2637983839.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2658617443.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.2904939987.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2701089699.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2773109484.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.2856013589.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2772478758.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2787040179.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2764459215.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2771861469.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2770124965.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2766130893.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2767828792.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2772321065.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2772170828.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2768439722.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.2768538647.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2776915066.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2772216438.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2773680469.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2758812796.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.2772704180.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.2773205781.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000020.00000002.2772158510.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.2873398411.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.2775937894.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.2761298877.00007FFB0C6EA000.00000040.00000001.0100000
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: loaddll64.exe, loaddll64.exe, 00000000.00000002.2768698425.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, regsvr32.exe, regsvr32.exe, 00000004.00000002.2633003757.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, rundll32.exe, 00000005.00000002.2637983839.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2658617443.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.2904939987.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000C.00000002.2701089699.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.2773109484.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.2856013589.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2772478758.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2787040179.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2764459215.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2771861469.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2770124965.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2766130893.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.2767828792.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2772321065.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2772170828.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2768439722.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.2768538647.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2776915066.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2772216438.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2773680469.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2758812796.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.2772704180.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.2773205781.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000020.00000002.2772158510.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.2873398411.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.2775937894.00007FFB0C6EA000.00000040.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.2761298877.0

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name:
Source: UxTheme.dll.dll	Static PE information: section name: .boot

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\UxTheme.dll.dll

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DD235D push edi; iretd	0_2_0000013678DD235E
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DF243F push ebp; iretd	0_2_0000013678DF2440
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DF245F push ebp; iretd	0_2_0000013678DF2460
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DD3D58 push ebp; iretd	0_2_0000013678DD3D59
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DF2488 push ebp; iretd	0_2_0000013678DF2489
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DE1EF6 push edx; ret	0_2_0000013678DE1EF7
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000013678DD271E push cs; retf	0_2_0000013678DD271F

Source: UxTheme.dll.dll

Static PE information: section name: entropy: 7.96741105930464

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Windows\System32\loaddll64.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: FilemonClass
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Windows\System32\rundll32.exe	Window searched: window name: RegmonClass

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\loaddll64.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	System information queried: FirmwareTableInformation			Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Windows\System32\loaddll64.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\rundll32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: rundll32.exe, 00000023.00000002.2760933840.00000280F2458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL$
Source: rundll32.exe, 00000027.00000002.2773806655.000001D8CDF68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLJH
Source: regsvr32.exe, 00000004.00000002.2632797000.00000000009EB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2768545737.0000011C192B8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000016.00000002.2769800847.00000215C2788000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000018.00000002.2767556258.000001AE5C5E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: rundll32.exe, 00000024.00000002.2772781234.000001B683328000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL'
Source: rundll32.exe, 0000000F.00000002.2767623987.0000018A21898000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL5
Source: rundll32.exe, 00000019.00000002.2755670049.0000026D95968000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLS
Source: rundll32.exe, 00000015.00000002.2767093911.0000011319018000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL}

Source: C:\Windows\System32\rundll32.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Windows\System32\rundll32.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Windows\System32\rundll32.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed

Source: rundll32.exe, 0000001D.00000002.2758361312.000001C4AED58000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001E.00000002.2769511865.000001DE1A4A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000020.00000002.2769852932.000001F8DCC48000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000025.00000002.2771437325.000001D464168000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: rundll32.exe, 00000015.00000002.2767093911.0000011319018000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000021.00000002.2873046801.00000240FF928000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__#
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: rundll32.exe, 00000029.00000002.2758721043.0000022766D98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__m?$tS
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: rundll32.exe, 00000026.00000002.2768659401.00000164F1AC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__m@
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.10.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\loaddll64.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Windows\System32\loaddll64.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger
Source: C:\Windows\System32\rundll32.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Windows\System32\rundll32.exe	Open window title or class name: regmonclass
Source: C:\Windows\System32\rundll32.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Windows\System32\rundll32.exe	Open window title or class name: procmon_window_class
Source: C:\Windows\System32\rundll32.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Windows\System32\rundll32.exe	Open window title or class name: filemonclass
Source: C:\Windows\System32\rundll32.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugObjectHandle
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_3_0000013678914670 LdrLoadDll,

0_3_0000013678914670

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtQuerySystemInformation: Indirect: 0x7FFB0C885ADD	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQueryInformationProcess: Indirect: 0x7FFB0C89C164	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x13678910955	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtSetInformationThread: Indirect: 0x7FFB0C8B9FA2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Indirect: 0x136789102AF	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Indirect: 0x136789101F2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtQueryInformationProcess: Indirect: 0x7FFB0C8B3FF9	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 16.3.rundll32.exe.256a6980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll64.exe.13678d70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll64.exe.13678d70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.14571620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.14571620000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.rundll32.exe.256a6980000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000003.2777687515.00000256A6980000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2786136846.00000256A8758000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2753368272.0000013678D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2658150493.00000145716A8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2657321127.0000014571620000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2754647446.0000013678DF8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 3868, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6788, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	32 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Process Injection	LSASS Memory	32 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Regsvr32	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UxTheme.dll.dll	38%	Virustotal		Browse
UxTheme.dll.dll	34%	ReversingLabs	Win64.Trojan.Malgent

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
us-central1-keepass-415209.cloudfunctions.net	0%	Avira URL Cloud	safe
us-central1-keepass-415209.cloudfunctions.net	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
us-central1-keepass-415209.cloudfunctions.net	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.10.dr	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1468058
Start date and time:	2024-07-05 09:39:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UxTheme.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	UxTheme.dll.exe
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@76/5@0/0
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): client.wns.windows.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target regsvr32.exe, PID 6472 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 6536 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
03:42:37	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_UxT_5fdac553aa43d04157a813c478cdafc56a856f_b52680da_6f5a37d7-5487-47c5-adc5-651ed76d0d82\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7768697010274644
Encrypted:	false
SSDEEP:	192:LkcirzyZah0z5p6AR2KjEEzuiFDZ24lO8Y:xirGZZtdRzjXzuiFDY4lO8Y
MD5:	963F729CFA2F0A5832022AB29D559301
SHA1:	E9E0B7425F524C37DB1651DE4DF7C7177DBE2BB0
SHA-256:	6941170414F52CE5E071500A47654A05DFED0A8E36AA87E0839D0860D9F5444C
SHA-512:	7D4C713923254D045B326899EA099FA7BDD68BA8E7E20DF731974868BDBDF31C8DADC9AB13B55B293FC19E066B370F46330F1B1D65576210CE1ABE3C974E625F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.6.3.8.9.3.5.3.1.4.9.9.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.6.3.8.9.3.5.9.5.5.6.2.9.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.f.5.a.3.7.d.7.-.5.4.8.7.-.4.7.c.5.-.a.d.c.5.-.6.5.1.e.d.7.6.d.0.d.8.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.2.8.b.8.4.a.e.-.f.9.a.3.-.4.7.6.2.-.9.3.1.3.-.6.5.6.2.7.6.e.0.a.e.f.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.U.x.T.h.e.m.e...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.1.4.-.0.0.0.1.-.0.0.1.4.-.9.e.c.a.-.8.e.d.a.a.e.c.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8203.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 5 07:42:15 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	70834
Entropy (8bit):	1.6308510172406367
Encrypted:	false
SSDEEP:	384:nZuxNPM8ga3mDuEQQ7+n9Arb/lHUwKII/n4:ExBM8ga3mDuEQQ7+n9Arb/ub4
MD5:	7D9C38D2089C8F309CDD9BB102F46EAB
SHA1:	8328E8E3D734B222660360F89C801BC771B32E54
SHA-256:	7D16A5AB474520A0B7E08AC5BBDB6B6C833D88C8431751E9FDEE5E6AD65370B8
SHA-512:	EB8356093C976CD8A2C6C00693981AD714241525E8C4D4130D9928A516D5CECCFFBB3439D44B5DA9766C03B11CA2BE52B02E4A86DE9FF70419AE13A4D41B158B
Malicious:	false
Preview:	MDMP..a..... .........f........................$...........4...2/..........T.......8...........T.......................................................................................................................eJ......t.......Lw......................T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER82A1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8532
Entropy (8bit):	3.696948668820715
Encrypted:	false
SSDEEP:	192:R6l7wVeJXvJ6Y8NHLqgmfOk52ll6WjprO89bZZalfNwTm:R6lXJfJ6YOmgmfOkk9Zefr
MD5:	C00E1DE23D59905A278527DD7B49C252
SHA1:	7C094DC623A05B1EA5F60E3D728B8A8D98918F18
SHA-256:	B0BD6EE189C6A0570FC3CFA004CFD1EE0A92157716FDCDA9E1B58B195B47484D
SHA-512:	32B52177F496987487375AA219028F742111A4D4EB47F94D9A24EFC33C7645166F1ACD18DCBFAD295128A33FEE90EB12A2368057442B882948B17FCD43673FFC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.1.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER835D.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4766
Entropy (8bit):	4.484819997687503
Encrypted:	false
SSDEEP:	48:cvIwWl8zsiJg771I9wTWpW8VYlYm8M4JCDCb4bf6FPyq85m0QEftRoptSTS6d:uIjfwI73i7VpJawGDopoO6d
MD5:	81B1170D1AC8436C552B4C2F5B040B55
SHA1:	694AF4EC394791FC24DFA501FD42A3C659E947B4
SHA-256:	265EFC7621AB2B407BBE517AAA74CCEACC5DA3BAA77E32549A570DA332E34E83
SHA-512:	FB7F9CE4D0E6B54129E8CE74D7D08A85F246F386B61D62922D1C25E77CC3C83C53BCED3C031D862D69991BF402F8CBFF099BAD84AD323CF4D270E1CC30B080E2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="397364" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417562630385475
Encrypted:	false
SSDEEP:	6144:Dcifpi6ceLPL9skLmb0mNSWSPtaJG8nAgex285i2MMhA20X4WABlGuN55+:4i58NSWIZBk2MM6AFBTo
MD5:	895270160F47525D6805963733ACF6E3
SHA1:	9D74F9A14E735EAFEA097ABC986AD9D60FDA3C08
SHA-256:	07B6879BF759D08F02C74969DF8CE1C1474CEBF05EEF00B36F2FCE4E0755F948
SHA-512:	623A8D9DBF4F37E3C503DFDC2C93F4336BBF40A742A00EEB7CDB03918F64090FBF01CAA5E0C90067CE1E34FD8D2263D60C0F194424C7FE7F4507AA7341E33FC3
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.3.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.969585217240325
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 84.97% Win64 Executable (generic) (12005/4) 10.00% Clipper DOS Executable (2020/12) 1.68% Generic Win/DOS Executable (2004/3) 1.67% DOS Executable Generic (2002/1) 1.67%
File name:	UxTheme.dll.dll
File size:	3'842'048 bytes
MD5:	336bed2506b03c75235a8549888e64b9
SHA1:	da0808fe16c9b3cf20a133d56343d45bf0faf8ea
SHA256:	d25d0df1669dc0f2c1eff862518b263fb3ced9e4ec2a150de6af06939dd9738e
SHA512:	fe9771061779aae98eb5e1f2c069234e7b24bff54436b7493dd8671ee4204da0a6c91d3af98e4d76f1455c1e037e0f0be42cb8fd9c19646f9addecdf305fbfc4
SSDEEP:	49152:ZuEhSSGlLCz7rOvqtJgGQ2TCH4dKG3Uhu7Vc8GnCxwkxZdV9Jp8BsSgMOcLi/CRy:MrFQPg47o4YYgzaTpT/
TLSH:	4406333EE794A311E42290FF527726954B427C41012B84151B3D727B988B31FBF7BA9E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................................................................................................V.........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180622058
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x6050E9AC [Tue Mar 16 17:23:56 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1ee602fa73839d068ce001610045c627

Entrypoint Preview

Instruction
call 00007FCBD4CFDCD7h
inc ecx
push edx
dec ecx
mov edx, esp
inc ecx
push edx
dec ecx
mov esi, dword ptr [edx+10h]
dec ecx
mov edi, dword ptr [edx+20h]
cld
mov dl, 80h
mov al, byte ptr [esi]
dec eax
inc esi
mov byte ptr [edi], al
dec eax
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007FCBD4CFDB59h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007FCBD4CFDB36h
add dl, dl
jne 00007FCBD4CFDB59h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007FCBD4CFDBB0h
xor eax, eax
add dl, dl
jne 00007FCBD4CFDB59h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jnc 00007FCBD4CFDC58h
add dl, dl
jne 00007FCBD4CFDB59h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FCBD4CFDB59h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FCBD4CFDB59h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FCBD4CFDB59h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
je 00007FCBD4CFDB5Bh
push edi
mov eax, eax
dec eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
dec eax
inc edi
mov ebx, 00000002h
jmp 00007FCBD4CFDADAh
mov eax, 00000001h
add dl, dl
jne 00007FCBD4CFDB59h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FCBD4CFDB59h
mov dl, byte ptr [esi]
dec eax
inc esi
adc dl, dl
jc 00007FCBD4CFDB38h
sub eax, ebx
mov ebx, 00000001h
jne 00007FCBD4CFDB80h
mov ecx, 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x72000	0x1bed	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x74059	0x88	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x75000	0x2c75	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x5f2a70	0xde0	.text
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0xb710	0x6c00	61e4ea28b40a5a5d6c35e1e66e6dcf30	False	0.9977936921296297	data	7.96741105930464	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0xd000	0xb056	0x4000	fa6501889363a4b1230c7bec43873a3d	False	0.9974365234375	data	7.919757017886685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x19000	0x54640	0x53600	6bb3700a1386fe667224c7c80781ac4c	False	0.9931918806221889	data	7.997561975945916	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6e000	0xdc8	0x800	5192ad92e4646acd96a90c3ece20bab6	False	0.95263671875	data	7.447430095951343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x6f000	0xfc	0x200	9e076fd784712f5d899f3d7b496e91f3	False	0.70703125	data	5.156677793705186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x70000	0x1e0	0x200	8ac07fcd9f594e0acc9411b007028de4	False	0.9609375	data	6.601045638978476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x71000	0x660	0x600	211152a2eb7f9da796b11f822bde5a26	False	0.8138020833333334	data	7.262399670945199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.edata	0x72000	0x1c00	0x1c00	6d9172f91cf39d748bcd639fe6cca9c7	False	0.23465401785714285	data	5.161511276647459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x74000	0x1000	0x200	5962833ab5f52f166e2a2c4cb1244358	False	0.22265625	data	1.6942228613747352	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x75000	0x2c75	0x2e00	36fbd34f812fd4ef2c94c29dcddfdc5f	False	0.3226902173913043	data	4.8024961532845065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.text	0x78000	0x5aa000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x622000	0x345c00	0x345c00	542d6704d2affc689683ef56316b3cd8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_DIALOG	0x75508	0x144	data	English	United States	0.5555555555555556
RT_DIALOG	0x7564c	0x138	data	English	United States	0.5480769230769231
RT_DIALOG	0x75784	0x120	data	English	United States	0.625
RT_DIALOG	0x758a4	0x144	data	English	United States	0.5493827160493827
RT_DIALOG	0x759e8	0x188	data	English	United States	0.5637755102040817
RT_DIALOG	0x75b70	0xa4	data	English	United States	0.6402439024390244
RT_DIALOG	0x75c14	0xbc	data	English	United States	0.6648936170212766
RT_DIALOG	0x75cd0	0x148	data	English	United States	0.5365853658536586
RT_STRING	0x75e18	0xb	ASCII text, with no line terminators	English	United States	1.7272727272727273
RT_STRING	0x75e24	0xa	ASCII text, with no line terminators	English	United States	1.8
RT_STRING	0x75e30	0xb	ASCII text, with no line terminators	English	United States	1.7272727272727273
RT_STRING	0x75e3c	0xe	ASCII text, with no line terminators	English	United States	1.5714285714285714
RT_STRING	0x75e4c	0xb	ASCII text, with no line terminators	English	United States	1.7272727272727273
RT_RCDATA	0x75e58	0x1e6	ASCII text			0.5185185185185185
RT_RCDATA	0x76040	0xe7	ASCII text			0.7575757575757576
RT_RCDATA	0x76128	0x295	ASCII text			0.5052950075642966
RT_RCDATA	0x763c0	0x397	ASCII text			0.4646354733405876
RT_RCDATA	0x76758	0x3b1	ASCII text			0.4444444444444444
RT_RCDATA	0x76b0c	0x340	ASCII text			0.49399038461538464
RT_RCDATA	0x76e4c	0x2a8	ASCII text			0.4985294117647059
RT_RCDATA	0x770f4	0x313	ASCII text			0.49555273189326554
RT_RCDATA	0x77408	0x328	ASCII text			0.504950495049505
RT_VERSION	0x77730	0x3c8	data	English	United States	0.44834710743801653
RT_MANIFEST	0x77af8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	GetCursorPos
ADVAPI32.dll	CryptDestroyKey

Exports

Name	Ordinal	Address
BeginBufferedAnimation	37	0x180072837
BeginBufferedPaint	38	0x18007286a
BeginPanningFeedback	5	0x1800727a5
BufferedPaintClear	39	0x180072899
BufferedPaintInit	40	0x1800728c8
BufferedPaintRenderAnimation	41	0x1800728f6
BufferedPaintSetAlpha	42	0x18007292f
BufferedPaintStopAllAnimations	51	0x180072993
BufferedPaintUnInit	52	0x1800729ce
CloseThemeData	53	0x1800729fe
DllCanUnloadNow	54	0x180072a29
DllGetActivationFactory	55	0x180072a55
DllGetClassObject	56	0x180072a89
DrawThemeBackground	57	0x180072ab7
DrawThemeBackgroundEx	47	0x180072961
DrawThemeEdge	58	0x180072ae7
DrawThemeIcon	59	0x180072b11
DrawThemeParentBackground	70	0x180072b67
DrawThemeParentBackgroundEx	71	0x180072b9d
DrawThemeText	89	0x180072bd5
DrawThemeTextEx	103	0x180072c7a
EnableThemeDialogTexture	114	0x180072ca6
EnableTheming	129	0x180072d41
EndBufferedAnimation	134	0x180072d6b
EndBufferedPaint	140	0x180072d9c
EndPanningFeedback	6	0x1800727d6
GetBufferedPaintBits	141	0x180072dc9
GetBufferedPaintDC	142	0x180072dfa
GetBufferedPaintTargetDC	143	0x180072e29
GetBufferedPaintTargetRect	144	0x180072e5e
GetColorFromPreference	121	0x180072d0e
GetCurrentThemeName	145	0x180072e95
GetImmersiveColorFromColorSetEx	95	0x180072bff
GetImmersiveUserColorSetPreference	98	0x180072c3b
GetThemeAnimationProperty	146	0x180072ec5
GetThemeAnimationTransform	147	0x180072efb
GetThemeAppProperties	148	0x180072f32
GetThemeBackgroundContentRect	149	0x180072f64
GetThemeBackgroundExtent	150	0x180072f9e
GetThemeBackgroundRegion	151	0x180072fd3
GetThemeBitmap	152	0x180073008
GetThemeBool	153	0x180073033
GetThemeColor	154	0x18007305c
GetThemeDocumentationProperty	155	0x180073086
GetThemeEnumValue	156	0x1800730c0
GetThemeFilename	157	0x1800730ee
GetThemeFont	158	0x18007311b
GetThemeInt	159	0x180073144
GetThemeIntList	160	0x18007316c
GetThemeMargins	161	0x180073198
GetThemeMetric	162	0x1800731c4
GetThemePartSize	163	0x1800731ef
GetThemePosition	164	0x18007321c
GetThemePropertyOrigin	165	0x180073249
GetThemeRect	166	0x18007327c
GetThemeStream	167	0x1800732a5
GetThemeString	168	0x1800732d0
GetThemeSysBool	169	0x1800732fb
GetThemeSysColor	170	0x180073327
GetThemeSysColorBrush	171	0x180073354
GetThemeSysFont	172	0x180073386
GetThemeSysInt	173	0x1800733b2
GetThemeSysSize	174	0x1800733dd
GetThemeSysString	175	0x180073409
GetThemeTextExtent	176	0x180073437
GetThemeTextMetrics	177	0x180073466
GetThemeTimingFunction	178	0x180073496
GetThemeTransitionDuration	179	0x1800734c9
GetUserColorPreference	120	0x180072cdb
GetWindowTheme	180	0x180073500
HitTestThemeBackground	181	0x18007352b
IsAppThemed	182	0x18007355e
IsCompositionActive	183	0x180073586
IsThemeActive	184	0x1800735b6
IsThemeBackgroundPartiallyTransparent	185	0x1800735e0
IsThemeDialogTextureEnabled	186	0x180073622
IsThemePartDefined	187	0x18007365a
OpenThemeData	188	0x180073689
OpenThemeDataEx	61	0x180072b3b
OpenThemeDataForDpi	189	0x1800736b3
SetThemeAppProperties	190	0x1800736e3
SetWindowTheme	191	0x180073715
SetWindowThemeAttribute	192	0x180073740
ThemeInitApiHook	193	0x180073774
UpdatePanningFeedback	12	0x180072805
UpdateSignature	7	0x180001340

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	03:42:11
Start date:	05/07/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\UxTheme.dll.dll"
Imagebase:	0x7ff7ddd10000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2753368272.0000013678D70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2753368272.0000013678D70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000003.2753368272.0000013678D70000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2754647446.0000013678DF8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:42:11
Start date:	05/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:42:11
Start date:	05/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",#1
Imagebase:	0x7ff7cd350000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:42:11
Start date:	05/07/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\UxTheme.dll.dll
Imagebase:	0x7ff614900000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:42:11
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginBufferedAnimation
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:42:11
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",#1
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000006.00000002.2658118414.0000014571670000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000006.00000002.2658150493.00000145716A8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000006.00000003.2657321127.0000014571620000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000006.00000003.2657321127.0000014571620000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000006.00000003.2657321127.0000014571620000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:42:14
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginBufferedPaint
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:42:15
Start date:	05/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 4116 -s 416
Imagebase:	0x7ff697ad0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:42:17
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\UxTheme.dll.dll,BeginPanningFeedback
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:42:20
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginBufferedAnimation
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginBufferedPaint
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",BeginPanningFeedback
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",UpdateSignature
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000010.00000003.2777687515.00000256A6980000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000010.00000003.2777687515.00000256A6980000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000010.00000003.2777687515.00000256A6980000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000010.00000002.2786136846.00000256A8758000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000010.00000002.2786000448.00000256A8720000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",UpdatePanningFeedback
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",ThemeInitApiHook
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetWindowThemeAttribute
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetWindowTheme
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",SetThemeAppProperties
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeDataForDpi
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeDataEx
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",OpenThemeData
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemePartDefined
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeDialogTextureEnabled
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeBackgroundPartiallyTransparent
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsThemeActive
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsCompositionActive
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",IsAppThemed
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",HitTestThemeBackground
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetWindowTheme
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetUserColorPreference
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTransitionDuration
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTimingFunction
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTextMetrics
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeTextExtent
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysString
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysSize
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysInt
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:42:21
Start date:	05/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\UxTheme.dll.dll",GetThemeSysFont
Imagebase:	0x7ff6a9e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	10.3%
Total number of Nodes:	39
Total number of Limit Nodes:	6

Executed Functions

Function 0000013678DC7250 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtFreeVirtualMemory.NTDLL ref: 0000013678DC7348

Strings

0, xrefs: 0000013678DC72F5

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: FreeMemoryVirtual
String ID: 0
API String ID: 3963845541-4108050209
Opcode ID: be7bf1ef473da28bb5f91f183d5ab39302a82fd461ef0e65bce11a6ed52e3569
Instruction ID: a5f6c9e387af224af691ded328e58ff1f82aa2a4b1cc8ab945b9579a31a02132
Opcode Fuzzy Hash: be7bf1ef473da28bb5f91f183d5ab39302a82fd461ef0e65bce11a6ed52e3569
Instruction Fuzzy Hash: F2317231218B484FE754AB78845A79BBBD1FBC4354F908B2DF15AC22D1DF74C9418B82

Function 0000013678DE466C Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000013678DE5798: free.LIBCMT ref: 0000013678DE5833
Part of subcall function 0000013678DE5798: free.LIBCMT ref: 0000013678DE5844

ExitProcess.KERNEL32 ref: 0000013678DE4706

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$ExitProcess
String ID:
API String ID: 1723042469-0
Opcode ID: 5f2d819181d5e854bdf64fdbb18a83a8321b1100b31dbaa37a4cb39d60e3379a
Instruction ID: a8abbff8f8ba09d93e0d2ab5900cc56dd3ad29d2c09099ea1eb6d026bf694390
Opcode Fuzzy Hash: 5f2d819181d5e854bdf64fdbb18a83a8321b1100b31dbaa37a4cb39d60e3379a
Instruction Fuzzy Hash: 0411DB72A0860497F768BB74C48A3EDBBD1E784318F40C62EE116D72D1DE398E004752

Non-executed Functions

Function 0000013678DE9B80 Relevance: 30.8, APIs: 15, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

Part of subcall function 0000013678DE81F0: _getptd.LIBCMT ref: 0000013678DE8206
Part of subcall function 0000013678DE81F0: __updatetlocinfo.LIBCMT ref: 0000013678DE823B
Part of subcall function 0000013678DE81F0: __updatetmbcinfo.LIBCMT ref: 0000013678DE8262

_errno.LIBCMT ref: 0000013678DE9BE6

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

_fileno.LIBCMT ref: 0000013678DE9C13

Part of subcall function 0000013678DEC644: _errno.LIBCMT ref: 0000013678DEC64D
Part of subcall function 0000013678DEC644: _invalid_parameter_noinfo.LIBCMT ref: 0000013678DEC658

write_multi_char.LIBCMT ref: 0000013678DEA24F
write_string.LIBCMT ref: 0000013678DEA26C
write_multi_char.LIBCMT ref: 0000013678DEA289
write_string.LIBCMT ref: 0000013678DEA2E8
write_multi_char.LIBCMT ref: 0000013678DEA341
free.LIBCMT ref: 0000013678DEA355
_isleadbyte_l.LIBCMT ref: 0000013678DEA426
write_char.LIBCMT ref: 0000013678DEA43C
write_char.LIBCMT ref: 0000013678DEA45D
_errno.LIBCMT ref: 0000013678DEA560
_invalid_parameter_noinfo.LIBCMT ref: 0000013678DEA56B

Strings

, xrefs: 0000013678DEA223
@, xrefs: 0000013678DE9BFF

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3613058218-1077428164
Opcode ID: bd61a64bd559d6dcb89aea1aaa96a4f901907095869dcd47b38978befe06e487
Instruction ID: d8b9fecda2e79058a35deca09aa0391c1a2c862804105eb17da192d247bf5f3d
Opcode Fuzzy Hash: bd61a64bd559d6dcb89aea1aaa96a4f901907095869dcd47b38978befe06e487
Instruction Fuzzy Hash: 80621932919A4AAAF7689A59C4477FDFBD1FBA1308FA4C11DE487C31C2DA24DE428741

Function 0000013678DE9118 Relevance: 29.0, APIs: 15, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000013678DE81F0: _getptd.LIBCMT ref: 0000013678DE8206
Part of subcall function 0000013678DE81F0: __updatetlocinfo.LIBCMT ref: 0000013678DE823B
Part of subcall function 0000013678DE81F0: __updatetmbcinfo.LIBCMT ref: 0000013678DE8262

_errno.LIBCMT ref: 0000013678DE917E

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

_fileno.LIBCMT ref: 0000013678DE91AB

Part of subcall function 0000013678DEC644: _errno.LIBCMT ref: 0000013678DEC64D
Part of subcall function 0000013678DEC644: _invalid_parameter_noinfo.LIBCMT ref: 0000013678DEC658

write_multi_char.LIBCMT ref: 0000013678DE97DB
write_string.LIBCMT ref: 0000013678DE97F8
write_multi_char.LIBCMT ref: 0000013678DE9815
write_string.LIBCMT ref: 0000013678DE9874
write_multi_char.LIBCMT ref: 0000013678DE98CD
free.LIBCMT ref: 0000013678DE98E1
_isleadbyte_l.LIBCMT ref: 0000013678DE99B2
write_char.LIBCMT ref: 0000013678DE99C8
write_char.LIBCMT ref: 0000013678DE99E9
_errno.LIBCMT ref: 0000013678DE9AE3
_invalid_parameter_noinfo.LIBCMT ref: 0000013678DE9AEE

Strings

, xrefs: 0000013678DE97AF

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_charwrite_string$__updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3613058218-3916222277
Opcode ID: da73a8991e0d2704c5fbc01b634f326b5676758f607846b3f36967d33a884184
Instruction ID: 980647066d8ee45840dce9167b8f2a76e7b9fec7af0fb0e06ca8d2d7372abe15
Opcode Fuzzy Hash: da73a8991e0d2704c5fbc01b634f326b5676758f607846b3f36967d33a884184
Instruction Fuzzy Hash: 15622B3291AB49BAF7689A18C8933F9FBD2FB95318FA4921DD487C31D1D634DE028741

Function 0000013678DDFB38 Relevance: 13.3, APIs: 10, Instructions: 790
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 0000013678DDFCA5
_snprintf.LIBCMT ref: 0000013678DDFD66
_snprintf.LIBCMT ref: 0000013678DDFD83
_snprintf.LIBCMT ref: 0000013678DDFFD8
_snprintf.LIBCMT ref: 0000013678DE0002

Part of subcall function 0000013678DE622C: _errno.LIBCMT ref: 0000013678DE6263
Part of subcall function 0000013678DE622C: _invalid_parameter_noinfo.LIBCMT ref: 0000013678DE626E

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: ed4f66b9eb0b60d96691592701bfff5024a698260740415106ba7419c4ba1338
Instruction ID: 804c33571e2b7b320edcf29e293c9709f2909d209302b227fae040b4b02b2fbb
Opcode Fuzzy Hash: ed4f66b9eb0b60d96691592701bfff5024a698260740415106ba7419c4ba1338
Instruction Fuzzy Hash: D552E531118D89ABF75AAB2CD4437E5F7E0FF68309F949219D985C7152EB30EA82C781

Function 0000013678914F41 Relevance: 6.4, Strings: 3, Instructions: 2602COMMON

Download Yara Rule

Strings

, xrefs: 00000136789166EA
ZL;, xrefs: 00000136789151E4
0, xrefs: 0000013678915F9F

Memory Dump Source

Source File: 00000000.00000003.2753428763.0000013678910000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000013678910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13678910000_loaddll64.jbxd

Similarity

API ID:
String ID: $0$ZL;
API String ID: 0-1570617776
Opcode ID: c04e10647534e64838dc4e7ec501509a6b3f9f35b150a2a9bb91aa4b7e0437e3
Instruction ID: 525a07bc029731a22f244b7923a41cea08f8c27ad885634961711aefc1bf879c
Opcode Fuzzy Hash: c04e10647534e64838dc4e7ec501509a6b3f9f35b150a2a9bb91aa4b7e0437e3
Instruction Fuzzy Hash: 63133C3061CB488FE7B5EF28C455B9AB7E5FB98304F908A5D908EC3291DF749945CB82

Function 0000013678DC4571 Relevance: 6.4, Strings: 3, Instructions: 2602COMMON

Download Yara Rule

Strings

, xrefs: 0000013678DC5D1A
ZL;, xrefs: 0000013678DC4814
0, xrefs: 0000013678DC55CF

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: $0$ZL;
API String ID: 0-1570617776
Opcode ID: 06448746b24deac0e15ab91d32f829ce41d75453b0dc82c18b22bb16e3d55171
Instruction ID: 4102af80c2b5df878adca28d6e749ffd1458fb170b92fb58932ba5d6c32e7a4e
Opcode Fuzzy Hash: 06448746b24deac0e15ab91d32f829ce41d75453b0dc82c18b22bb16e3d55171
Instruction Fuzzy Hash: C0132F71218B488FE7B5EF28C459B9AB7E1FB98304F508A5DD09EC3291CF749945CB82

Function 000001367891712E Relevance: 2.0, Strings: 1, Instructions: 748COMMON

Download Yara Rule

Strings

ZL;, xrefs: 00000136789172F4

Memory Dump Source

Source File: 00000000.00000003.2753428763.0000013678910000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000013678910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13678910000_loaddll64.jbxd

Similarity

API ID:
String ID: ZL;
API String ID: 0-564850408
Opcode ID: 5be2b335273847eff61db50915aac6bc2c5abc6be7d181fcbd48a9f44d8961f0
Instruction ID: fd079675fa2ad512cebd76b99bf8a0ad44c4dcda70a61bf82a0e8b38d55fdfa7
Opcode Fuzzy Hash: 5be2b335273847eff61db50915aac6bc2c5abc6be7d181fcbd48a9f44d8961f0
Instruction Fuzzy Hash: 2C423D3061CB485FE7A5EB28C4597EAB6E6FBD8305F90892D908EC3295DF34D9418B42

Function 0000013678DC675E Relevance: 2.0, Strings: 1, Instructions: 748COMMON

Download Yara Rule

Strings

ZL;, xrefs: 0000013678DC6924

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ZL;
API String ID: 0-564850408
Opcode ID: 27dad52b2cb306d087f1098c6ef93517f008046be043ce7dcd771719f9afa9e7
Instruction ID: a8b551228cda293676199d32b15edd66296376034d4f3db6fbce9ad69deec182
Opcode Fuzzy Hash: 27dad52b2cb306d087f1098c6ef93517f008046be043ce7dcd771719f9afa9e7
Instruction Fuzzy Hash: DA423131618B484FE7A5EB68C8597DBB7D2FBD8305F908A2DD08EC3291DF3499458B42

Function 0000013678DE6D98 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 0000013678DE6DCC

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: f753d6ac8f4332dcfcf60cdb62b0aa11027d34c576d5b5c95b1f215df632f05e
Instruction ID: 99e61af40c9f6124365749c40ce0bba3c708fd5efc596ed69e61d7d467c5a1fd
Opcode Fuzzy Hash: f753d6ac8f4332dcfcf60cdb62b0aa11027d34c576d5b5c95b1f215df632f05e
Instruction Fuzzy Hash: 61A1EC31659A098FFFA4EFB5EC98AA537E2F774301721893A900AC3174DA3CD549DB50

Function 00000136789112C0 Relevance: 1.8, Strings: 1, Instructions: 517COMMON

Download Yara Rule

Strings

ZL;, xrefs: 0000013678911395

Memory Dump Source

Source File: 00000000.00000003.2753428763.0000013678910000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000013678910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13678910000_loaddll64.jbxd

Similarity

API ID:
String ID: ZL;
API String ID: 0-564850408
Opcode ID: 19013c7192c2998db012b5ee5c76ee51a9e6526d6ad9021287d7df6c0835f1a3
Instruction ID: 15c7d7f49815998a0320eeae460d6d76502b612fb0e852f5b1d1b3aaa49fafd9
Opcode Fuzzy Hash: 19013c7192c2998db012b5ee5c76ee51a9e6526d6ad9021287d7df6c0835f1a3
Instruction Fuzzy Hash: 24029230A1CB489FE764EB2CC45A7AABBD5FBC8304F90855DA48AC3295DF34D945CB42

Function 0000013678DC08F0 Relevance: 1.8, Strings: 1, Instructions: 517COMMON

Download Yara Rule

Strings

ZL;, xrefs: 0000013678DC09C5

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ZL;
API String ID: 0-564850408
Opcode ID: 8442d524e6c4a38b84636862eb89b104e0f66f5dd2435c5a69de2ac9332ee4c9
Instruction ID: bc49cf56bf1a5e21d7ad1cd5f57a131cf963bd34d50f1006aaa62bfd1f698029
Opcode Fuzzy Hash: 8442d524e6c4a38b84636862eb89b104e0f66f5dd2435c5a69de2ac9332ee4c9
Instruction Fuzzy Hash: 06025431618B484FE764EF68D45A79ABBD1FBD8304F508A2DE48AC3292DF34D945CB42

Function 00000136789100A0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

ZL;, xrefs: 000001367891017D

Memory Dump Source

Source File: 00000000.00000003.2753428763.0000013678910000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000013678910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13678910000_loaddll64.jbxd

Similarity

API ID:
String ID: ZL;
API String ID: 0-564850408
Opcode ID: 142b7ce1c7c986fae891d25b87e90acd813b815d1038af7ae6a49a0aef6ea954
Instruction ID: 7d6a02e63ba37d1b0f7ac739a204d1900834f6ae5c66faad6f307f9f64aed323
Opcode Fuzzy Hash: 142b7ce1c7c986fae891d25b87e90acd813b815d1038af7ae6a49a0aef6ea954
Instruction Fuzzy Hash: FA719731A18B085FE754EF38C84A7DABBE5FBD4304F90861DA49AC3295EB34D945C782

Function 0000013678DF47E0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28c713b99873312a6933a1e950f04861f45586520b813f328f06fa975c3fb11
Instruction ID: f6f87918bc5f7a4c9f0cb12c23516d2ed87fad2548e5ddfa94d09b520fd65ec0
Opcode Fuzzy Hash: d28c713b99873312a6933a1e950f04861f45586520b813f328f06fa975c3fb11
Instruction Fuzzy Hash: 0662FA312286558FD31CCB1CC5B1B7AB7E1FB8A340F44896DE28BCB692C639D945CB91

Function 0000013678DF3E70 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40edf187d78bb53a1f4ec515dd6ec4c77522bea898fc053b18807d4a7f53a1ad
Instruction ID: fa34ebf27cf353819bedfa316ad59e925fad1518607cd465422404837ee60c98
Opcode Fuzzy Hash: 40edf187d78bb53a1f4ec515dd6ec4c77522bea898fc053b18807d4a7f53a1ad
Instruction Fuzzy Hash: AA52FD312286558FD31CCF1CC5A1E7AB7E1FB8D340F448A6DE286CB692C639E945CB91

Function 0000013678914670 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2753428763.0000013678910000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000013678910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13678910000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e8c8b596b043d19c8d9660ca9e6a667663a4d49c3b47da1907467d2da9a5ba
Instruction ID: 95c63885c69c30dc6875f417c685e748e009b042d61ef927b6b6cacba2bb59a1
Opcode Fuzzy Hash: c3e8c8b596b043d19c8d9660ca9e6a667663a4d49c3b47da1907467d2da9a5ba
Instruction Fuzzy Hash: FC51C43071CB085FEB68AB2C84167BB7AD6FBC9314F90892DA04BC3285DE34DD028781

Function 0000013678DEDA0C Relevance: 16.6, APIs: 11, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000013678DEDA3E

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

__doserrno.LIBCMT ref: 0000013678DEDA35

Part of subcall function 0000013678DE8898: _getptd_noexit.LIBCMT ref: 0000013678DE889C

__doserrno.LIBCMT ref: 0000013678DEDA9B
_errno.LIBCMT ref: 0000013678DEDAA2
_invalid_parameter_noinfo.LIBCMT ref: 0000013678DEDB06

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 18132ebb3f4a70da883eecaa0bb4194176adacf636e917766caae3702a5b6196
Instruction ID: bf85d4c4c64ceb163b6b5f08731cf2e4900fb031abb77d9c4cacc62ed2cc4b63
Opcode Fuzzy Hash: 18132ebb3f4a70da883eecaa0bb4194176adacf636e917766caae3702a5b6196
Instruction Fuzzy Hash: 2D3136322087456EE3256F6C98973ECBFD0EB42328F958259E426972D3DAB09E018742

Function 0000013678DEE7F8 Relevance: 15.1, APIs: 10, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000013678DEE823

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

__doserrno.LIBCMT ref: 0000013678DEE81B

Part of subcall function 0000013678DE8898: _getptd_noexit.LIBCMT ref: 0000013678DE889C

__lock_fhandle.LIBCMT ref: 0000013678DEE867
_lseeki64_nolock.LIBCMT ref: 0000013678DEE880
_unlock_fhandle.LIBCMT ref: 0000013678DEE8A3

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 8a1414846f8ae69c8c0834781321c211a3ea89d75d9112808f99b657bddc2b01
Instruction ID: 718067c77fec28ea24af43288a67956ca0726f0e145066733be1d70c29a40e38
Opcode Fuzzy Hash: 8a1414846f8ae69c8c0834781321c211a3ea89d75d9112808f99b657bddc2b01
Instruction Fuzzy Hash: 57213532618A442EF3186B589C833FCBFD0EB8A339FC48249E46AC72D3C6B45D014362

Function 0000013678DEE680 Relevance: 15.1, APIs: 10, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000013678DEE6AB

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

__doserrno.LIBCMT ref: 0000013678DEE6A3

Part of subcall function 0000013678DE8898: _getptd_noexit.LIBCMT ref: 0000013678DE889C

__lock_fhandle.LIBCMT ref: 0000013678DEE6EF
_lseek_nolock.LIBCMT ref: 0000013678DEE708
_unlock_fhandle.LIBCMT ref: 0000013678DEE729

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: e08e8afefb5e1ed1288eaa8c70c349a183a38912cda52555ccd69b221b02a642
Instruction ID: f0cc49f96de5c76a9f11520ecfe3238e3a13c09525549a441bc003a04f76cfb3
Opcode Fuzzy Hash: e08e8afefb5e1ed1288eaa8c70c349a183a38912cda52555ccd69b221b02a642
Instruction Fuzzy Hash: E021F732A186406EF3197B18DC833FDBFD0DB8A339F958618E55A872D3D6B45D014752

Function 0000013678DED024 Relevance: 13.6, APIs: 9, Instructions: 89
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000013678DED04F

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

__doserrno.LIBCMT ref: 0000013678DED047

Part of subcall function 0000013678DE8898: _getptd_noexit.LIBCMT ref: 0000013678DE889C

__lock_fhandle.LIBCMT ref: 0000013678DED093
_unlock_fhandle.LIBCMT ref: 0000013678DED0CD

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: 1c3ae7bf2f131d3204e76b71d06c8acbef8e564e58e59c1052b2c6176ef77bc0
Instruction ID: 0cea419fc14e5a0e0fe7ba0bcb10d02ad4af2b885684e45ad57c0c09882f2ca8
Opcode Fuzzy Hash: 1c3ae7bf2f131d3204e76b71d06c8acbef8e564e58e59c1052b2c6176ef77bc0
Instruction Fuzzy Hash: 4A2105326086442FF3156B1CDC977FCBFD0EB82329F998249E46AC72D3DAA45D024352

Function 0000013678DEC848 Relevance: 13.6, APIs: 9, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000013678DEC869

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

__doserrno.LIBCMT ref: 0000013678DEC861

Part of subcall function 0000013678DE8898: _getptd_noexit.LIBCMT ref: 0000013678DE889C

__lock_fhandle.LIBCMT ref: 0000013678DEC8AD
_close_nolock.LIBCMT ref: 0000013678DEC8C0
_unlock_fhandle.LIBCMT ref: 0000013678DEC8D9

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 3d70402c67917632d9f1476d61cf5255035b19131c76902cc54b22fe87e88aa3
Instruction ID: 93263f78e9827135e77fb05990a8c6f10e44ac7c501bb551976e7cab28399612
Opcode Fuzzy Hash: 3d70402c67917632d9f1476d61cf5255035b19131c76902cc54b22fe87e88aa3
Instruction Fuzzy Hash: 1F212733525A446EF3186B248CD33ECBF90EB45339FE5855DE05A972D3D6B88E408751

Function 0000013678DE6B5C Relevance: 12.6, APIs: 10, Instructions: 116
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 0000013678DE6B8A

Part of subcall function 0000013678DE5E34: _errno.LIBCMT ref: 0000013678DE5E54

free.LIBCMT ref: 0000013678DE6B9F
free.LIBCMT ref: 0000013678DE6BC0
free.LIBCMT ref: 0000013678DE6BD5
free.LIBCMT ref: 0000013678DE6BE9
free.LIBCMT ref: 0000013678DE6BF5
free.LIBCMT ref: 0000013678DE6C20
free.LIBCMT ref: 0000013678DE6C41
free.LIBCMT ref: 0000013678DE6C5A
free.LIBCMT ref: 0000013678DE6C8B

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 48841d5b384ec69418d2f44923ace36953bcf12c7c2bb233f82406c8f8afdcd4
Instruction ID: 36e1116a8667cb4619c3694cf68c1262f6bf663bb534faa7946ad2f8f254e451
Opcode Fuzzy Hash: 48841d5b384ec69418d2f44923ace36953bcf12c7c2bb233f82406c8f8afdcd4
Instruction Fuzzy Hash: 37419532215E095FFBA5EB98E8D6BE8BBE1F75831DFD480289409C6191CA3C8E45CB10

Function 0000013678DCC60C Relevance: 11.6, APIs: 9, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 0000013678DCC6A9

Part of subcall function 0000013678DE5E74: _FF_MSGBANNER.LIBCMT ref: 0000013678DE5EA4
Part of subcall function 0000013678DE5E74: _NMSG_WRITE.LIBCMT ref: 0000013678DE5EAE
Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5EE2
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EED
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EF8

malloc.LIBCMT ref: 0000013678DCC6B3

Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5F08
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5F0D

malloc.LIBCMT ref: 0000013678DCC6BE
free.LIBCMT ref: 0000013678DCC87E
free.LIBCMT ref: 0000013678DCC886
free.LIBCMT ref: 0000013678DCC88E

Part of subcall function 0000013678DCD4F0: malloc.LIBCMT ref: 0000013678DCD53A
Part of subcall function 0000013678DCD4F0: malloc.LIBCMT ref: 0000013678DCD545
Part of subcall function 0000013678DCD4F0: free.LIBCMT ref: 0000013678DCD62C
Part of subcall function 0000013678DCD4F0: free.LIBCMT ref: 0000013678DCD634

free.LIBCMT ref: 0000013678DCC89A
free.LIBCMT ref: 0000013678DCC8A7
free.LIBCMT ref: 0000013678DCC8B4

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 5d381bd07e07abc5cc61bca33b8e964a0049242f17c35a6925a1d6c8d9ec1d95
Instruction ID: 89e0ffb7cafff120d085f9212f895257cc35f3fa82d9a7d9b384f3aa84153810
Opcode Fuzzy Hash: 5d381bd07e07abc5cc61bca33b8e964a0049242f17c35a6925a1d6c8d9ec1d95
Instruction Fuzzy Hash: 0B910A32318B485FD759AA2C94437FA7BD1EB85768F90535ED58AC32C3EE24DD028782

Function 0000013678DE6A00 Relevance: 10.6, APIs: 7, Instructions: 107
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000013678DE6A26

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

_invalid_parameter_noinfo.LIBCMT ref: 0000013678DE6A32
__crtIsPackagedApp.LIBCMT ref: 0000013678DE6A43
_dosmaperr.LIBCMT ref: 0000013678DE6A8D

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: e40d3c8a52f00debdf29b23577ddc16d369424b82a41f8c403c46455c076bb21
Instruction ID: 4cd2a199fb446852e803faeefc6302d51b840409c707a4a06782eb6c5aa8156d
Opcode Fuzzy Hash: e40d3c8a52f00debdf29b23577ddc16d369424b82a41f8c403c46455c076bb21
Instruction Fuzzy Hash: AF31F831614A095FFB58AF69A8063EABBD1FB88318F54C15DA40AC32D6DA38CD41C741

Function 0000013678DF132C Relevance: 10.6, APIs: 7, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000013678DF1345

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

__lock_fhandle.LIBCMT ref: 0000013678DF138D
__doserrno.LIBCMT ref: 0000013678DF13C2
_errno.LIBCMT ref: 0000013678DF13C9
_unlock_fhandle.LIBCMT ref: 0000013678DF13D9

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: f27d13967f6dfcd6a5307430cad8985e1ca3dc7c562c85e054a4792eecbdb70d
Instruction ID: 3e1c8e75cd2132d614b35d5f0d84f4b38b564907a4d70b0b1596096f857a0d68
Opcode Fuzzy Hash: f27d13967f6dfcd6a5307430cad8985e1ca3dc7c562c85e054a4792eecbdb70d
Instruction Fuzzy Hash: 98216432604741AEFB26ABA898933EC7EC0EB55318FC4821CE036872D2C6B49E009B51

Function 0000013678DE7700 Relevance: 9.3, APIs: 6, Instructions: 257
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000013678DE773C

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

_invalid_parameter_noinfo.LIBCMT ref: 0000013678DE7747
memcpy_s.LIBCMT ref: 0000013678DE780C
_fileno.LIBCMT ref: 0000013678DE7877
_filbuf.LIBCMT ref: 0000013678DE78A5
_errno.LIBCMT ref: 0000013678DE78F5

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction ID: 01000f89bb79e4e257398d5a927c6661b13cdbe1890b31871b193fbc76e29c09
Opcode Fuzzy Hash: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction Fuzzy Hash: F3610D32228F092AE7AC666C48873B9FBD1E795734FA4832ED455C32D1DE60DD5283C1

Function 0000013678DF67C0 Relevance: 9.1, APIs: 6, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000013678DE81F0: _getptd.LIBCMT ref: 0000013678DE8206
Part of subcall function 0000013678DE81F0: __updatetlocinfo.LIBCMT ref: 0000013678DE823B
Part of subcall function 0000013678DE81F0: __updatetmbcinfo.LIBCMT ref: 0000013678DE8262

_errno.LIBCMT ref: 0000013678DF680F
_invalid_parameter_noinfo.LIBCMT ref: 0000013678DF681A

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: __updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808835054-0
Opcode ID: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction ID: e968198e772fd0bc8bd7d55de3d454c87f99ed868a994202fa0c68d4f80c1090
Opcode Fuzzy Hash: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction Fuzzy Hash: 5631E571518B486FD754DF58A0827A9BFD0FB68328F90829DE429C72D6DB70DD40DB81

Function 0000013678DE7210 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000013678DE7167

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

_invalid_parameter_noinfo.LIBCMT ref: 0000013678DE7172
_getstream.LIBCMT ref: 0000013678DE7192
_errno.LIBCMT ref: 0000013678DE71A4
_errno.LIBCMT ref: 0000013678DE71B6
_openfile.LIBCMT ref: 0000013678DE71E4

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: aea42a6da675c9ef6e6bb8b8e91e805078560935a98c47ae5044fabd1e1da4ae
Instruction ID: 71c22e6880299bba51d10b310f7b8dca6c1a184f378e253b13ebd27fddda7d74
Opcode Fuzzy Hash: aea42a6da675c9ef6e6bb8b8e91e805078560935a98c47ae5044fabd1e1da4ae
Instruction Fuzzy Hash: B521F832618B496FF790AB2848033AAFFD1FB99318F85855A9445D3292DF34CE414391

Function 0000013678DCC170 Relevance: 8.9, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000013678DCC1BD

Part of subcall function 0000013678DE5E74: _FF_MSGBANNER.LIBCMT ref: 0000013678DE5EA4
Part of subcall function 0000013678DE5E74: _NMSG_WRITE.LIBCMT ref: 0000013678DE5EAE
Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5EE2
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EED
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EF8

malloc.LIBCMT ref: 0000013678DCC1C8

Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5F08
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5F0D

free.LIBCMT ref: 0000013678DCC2AF
free.LIBCMT ref: 0000013678DCC2B7
free.LIBCMT ref: 0000013678DCC2BF
free.LIBCMT ref: 0000013678DCC2CB
free.LIBCMT ref: 0000013678DCC2D8

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: c2f67a7a0a72836e94fad93a939ec52e5ab87d845e1a419a5e47157519d33b6e
Instruction ID: 0fb461771d9f2c709f5e686b441936602fa629d2b0567b60b7caf8bb02c30a09
Opcode Fuzzy Hash: c2f67a7a0a72836e94fad93a939ec52e5ab87d845e1a419a5e47157519d33b6e
Instruction Fuzzy Hash: 0751E731618F096FE7599B6894463BAB7D0FB49318F90526DD94AC3287EF20DD028784

Function 0000013678DD4A74 Relevance: 7.9, APIs: 6, Instructions: 411COMMON

Download Yara Rule

APIs

Part of subcall function 0000013678DDDFF0: malloc.LIBCMT ref: 0000013678DDE00C

malloc.LIBCMT ref: 0000013678DD4B3B

Part of subcall function 0000013678DE5E74: _FF_MSGBANNER.LIBCMT ref: 0000013678DE5EA4
Part of subcall function 0000013678DE5E74: _NMSG_WRITE.LIBCMT ref: 0000013678DE5EAE
Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5EE2
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EED
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EF8

Part of subcall function 0000013678DE2E28: malloc.LIBCMT ref: 0000013678DE2E94

Part of subcall function 0000013678DE56A0: malloc.LIBCMT ref: 0000013678DE56F0

Part of subcall function 0000013678DE56A0: realloc.LIBCMT ref: 0000013678DE56FF

malloc.LIBCMT ref: 0000013678DD4C4A
_snprintf.LIBCMT ref: 0000013678DD4CC1
_snprintf.LIBCMT ref: 0000013678DD4CE7
_snprintf.LIBCMT ref: 0000013678DD4D0E
free.LIBCMT ref: 0000013678DD4EC6

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno$_callnewhfreerealloc
String ID:
API String ID: 74200508-0
Opcode ID: 047208885cf629ea2cae4dbf681448a9bb5cd42041197bd2c6b9d61aa6dad07d
Instruction ID: 19245e931eb3804c10314d827e7c66631fa3851ac11eb5af0376b317fec8d5fc
Opcode Fuzzy Hash: 047208885cf629ea2cae4dbf681448a9bb5cd42041197bd2c6b9d61aa6dad07d
Instruction Fuzzy Hash: 8DD18632704A0467EB58BB7494577E9BBD2EB84308FE0956EB446C32C3EE24DE058B91

Function 0000013678DDB1F8 Relevance: 7.8, APIs: 6, Instructions: 264stringCOMMON

Download Yara Rule

APIs

strchr.LIBCMT ref: 0000013678DDB232
strchr.LIBCMT ref: 0000013678DDB250
malloc.LIBCMT ref: 0000013678DDB268
malloc.LIBCMT ref: 0000013678DDB275
free.LIBCMT ref: 0000013678DDB45F
free.LIBCMT ref: 0000013678DDB467

Part of subcall function 0000013678DE5E34: _errno.LIBCMT ref: 0000013678DE5E54

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$_errno
String ID:
API String ID: 4025974267-0
Opcode ID: 5673eae19a0e561bdbd1139d9e451eb32bd38d37b55d865a525908fae5e06296
Instruction ID: a113b19bbd4949fd33f4385c8897c5d6f469ab7071924ea9f45c25542af3cd24
Opcode Fuzzy Hash: 5673eae19a0e561bdbd1139d9e451eb32bd38d37b55d865a525908fae5e06296
Instruction Fuzzy Hash: 5781F931618E886AE766AB2C94033FAFBD1FF9930DF80416ED589C7193DE248E46C751

Function 0000013678DD9698 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0000013678DDDFF0: malloc.LIBCMT ref: 0000013678DDE00C

Part of subcall function 0000013678DE7210: _errno.LIBCMT ref: 0000013678DE7167
Part of subcall function 0000013678DE7210: _invalid_parameter_noinfo.LIBCMT ref: 0000013678DE7172

fseek.LIBCMT ref: 0000013678DD9734

Part of subcall function 0000013678DE7A94: _errno.LIBCMT ref: 0000013678DE7ABC
Part of subcall function 0000013678DE7A94: _invalid_parameter_noinfo.LIBCMT ref: 0000013678DE7AC7

_ftelli64.LIBCMT ref: 0000013678DD973C

Part of subcall function 0000013678DE7B08: _errno.LIBCMT ref: 0000013678DE7B26
Part of subcall function 0000013678DE7B08: _invalid_parameter_noinfo.LIBCMT ref: 0000013678DE7B31

fseek.LIBCMT ref: 0000013678DD974C

Part of subcall function 0000013678DE7A94: _fseek_nolock.LIBCMT ref: 0000013678DE7AE5

malloc.LIBCMT ref: 0000013678DD978C

Part of subcall function 0000013678DE5E74: _FF_MSGBANNER.LIBCMT ref: 0000013678DE5EA4
Part of subcall function 0000013678DE5E74: _NMSG_WRITE.LIBCMT ref: 0000013678DE5EAE
Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5EE2
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EED
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EF8

fclose.LIBCMT ref: 0000013678DD9849

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: 9720734a985e3cbddb0c986b5420d504e31cc35e52c12b4a9c10f9ebd5591f36
Instruction ID: e774fcec972e4f365f674fd0b17b8ef09c382628e5cec9d51ae095118edd5fb5
Opcode Fuzzy Hash: 9720734a985e3cbddb0c986b5420d504e31cc35e52c12b4a9c10f9ebd5591f36
Instruction Fuzzy Hash: C951B432618A085FE749EB2894577F976D1FB88714F90826EE44BC32D7DD249E028BC1

Function 0000013678DF0F38 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 0000013678DF0F65

Part of subcall function 0000013678DEAA48: _FF_MSGBANNER.LIBCMT ref: 0000013678DEAA65
Part of subcall function 0000013678DEAA48: _NMSG_WRITE.LIBCMT ref: 0000013678DEAA6F

_lock.LIBCMT ref: 0000013678DF0F78
_lock.LIBCMT ref: 0000013678DF0FD3
_calloc_crt.LIBCMT ref: 0000013678DF108A

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: bf4c13b5270503a4abd82548ba536fbf1806decc40b0578f94ecd9bb06afaf17
Instruction ID: db3eaf8301c884173bc7916b792a7894d54933dcf4ac5837abad24fa1457a5f8
Opcode Fuzzy Hash: bf4c13b5270503a4abd82548ba536fbf1806decc40b0578f94ecd9bb06afaf17
Instruction Fuzzy Hash: 36513A31518B499FEB149F18C8427A5BBD0FF68314F91815DE85AC71A2D774DD41CF82

Function 0000013678DCD4F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000013678DCD53A

Part of subcall function 0000013678DE5E74: _FF_MSGBANNER.LIBCMT ref: 0000013678DE5EA4
Part of subcall function 0000013678DE5E74: _NMSG_WRITE.LIBCMT ref: 0000013678DE5EAE
Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5EE2
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EED
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EF8

malloc.LIBCMT ref: 0000013678DCD545

Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5F08
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5F0D

free.LIBCMT ref: 0000013678DCD62C
free.LIBCMT ref: 0000013678DCD634
free.LIBCMT ref: 0000013678DCD640
free.LIBCMT ref: 0000013678DCD64D

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: f976f75d609109cfe45b7f42c156cc71c0f6e702b52c7f4d8ab9b9eb4d0c589d
Instruction ID: 46357c68de09261fa550220982e5d0661be2ad28a09306f55efd3572a02726cc
Opcode Fuzzy Hash: f976f75d609109cfe45b7f42c156cc71c0f6e702b52c7f4d8ab9b9eb4d0c589d
Instruction Fuzzy Hash: A7412B32258B0D5FE759AB28485B3BA7BD4E795358F94822DE48BC3243ED20DD0387C0

Function 0000013678DE8F8C Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0000013678DE8FA9

Part of subcall function 0000013678DEC644: _errno.LIBCMT ref: 0000013678DEC64D
Part of subcall function 0000013678DEC644: _invalid_parameter_noinfo.LIBCMT ref: 0000013678DEC658

_errno.LIBCMT ref: 0000013678DE8FB9

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

_errno.LIBCMT ref: 0000013678DE8FD5
_isatty.LIBCMT ref: 0000013678DE9036
_getbuf.LIBCMT ref: 0000013678DE9042

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: 9fabdea84d0824fac2734452a9f63b1252c016be94808478d1f2e6cd97a01d2a
Instruction ID: 5bca3b2522c87bbaab35af9d4fbc4603f404c88b2accb549baf3adf5caca9dab
Opcode Fuzzy Hash: 9fabdea84d0824fac2734452a9f63b1252c016be94808478d1f2e6cd97a01d2a
Instruction Fuzzy Hash: 4351D532114A486FEB98EF18C483BA5BBD2FB54314FD48559D855CB2C6D674CE41C781

Function 0000013678DE1220 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000013678DE124F

Part of subcall function 0000013678DE5E74: _FF_MSGBANNER.LIBCMT ref: 0000013678DE5EA4
Part of subcall function 0000013678DE5E74: _NMSG_WRITE.LIBCMT ref: 0000013678DE5EAE
Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5EE2
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EED
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EF8

_snprintf.LIBCMT ref: 0000013678DE1267

Part of subcall function 0000013678DE622C: _errno.LIBCMT ref: 0000013678DE6263
Part of subcall function 0000013678DE622C: _invalid_parameter_noinfo.LIBCMT ref: 0000013678DE626E

free.LIBCMT ref: 0000013678DE127E

Part of subcall function 0000013678DE5E34: _errno.LIBCMT ref: 0000013678DE5E54

malloc.LIBCMT ref: 0000013678DE12CE
_snprintf.LIBCMT ref: 0000013678DE12E6
free.LIBCMT ref: 0000013678DE130E

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: 7fbd6a351a4cb820a75f12ea8225a7df12219c348c581bb7f064621535b48d3b
Instruction ID: 5b184c578cd273fe21f947b6abaf3acfe1b4e91c59337b987824872a37132d47
Opcode Fuzzy Hash: 7fbd6a351a4cb820a75f12ea8225a7df12219c348c581bb7f064621535b48d3b
Instruction Fuzzy Hash: 4F41BC3170CD481FDB58AB2C68573F8BBE2E789314F94829DD08EC3297D924DD028781

Function 0000013678DD7C68 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000013678DD7C89

Part of subcall function 0000013678DE5E74: _FF_MSGBANNER.LIBCMT ref: 0000013678DE5EA4
Part of subcall function 0000013678DE5E74: _NMSG_WRITE.LIBCMT ref: 0000013678DE5EAE
Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5EE2
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EED
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EF8

free.LIBCMT ref: 0000013678DD7CC4
fwrite.LIBCMT ref: 0000013678DD7D05
fclose.LIBCMT ref: 0000013678DD7D0D
free.LIBCMT ref: 0000013678DD7D1A

Part of subcall function 0000013678DE5E34: _errno.LIBCMT ref: 0000013678DE5E54

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: 4044c7cfb370f8cbb2fe880fee6f96d794ba6fb0331d43b2e22f2d93f87d349f
Instruction ID: 91021c5432d90cb6d0dc3d915154f6a28fd3f836da0a5cf46aa5fb0ac8503c91
Opcode Fuzzy Hash: 4044c7cfb370f8cbb2fe880fee6f96d794ba6fb0331d43b2e22f2d93f87d349f
Instruction Fuzzy Hash: AD218632218E085BE798F72C44567EDBAD1FB9C348FA0856E744AC32C6DD248E014791

Function 0000013678DF11DC Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000013678DF11ED

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

__doserrno.LIBCMT ref: 0000013678DF11E5

Part of subcall function 0000013678DE8898: _getptd_noexit.LIBCMT ref: 0000013678DE889C

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 37268f2f3763d0ffa2fcafc6510c2b93f8b56cf813f77b885a3d7f14ba8a0b7c
Instruction ID: ed956d86a5ed9a8d647cb29d180ea0c3a867b8d4fdddabb430407a1f0d44fc40
Opcode Fuzzy Hash: 37268f2f3763d0ffa2fcafc6510c2b93f8b56cf813f77b885a3d7f14ba8a0b7c
Instruction Fuzzy Hash: 2B0186325645896EFB5AA76488533D87EA1FB2232EFD4C244E429C71D2E67C4F409712

Function 0000013678DD6C08 Relevance: 6.5, APIs: 5, Instructions: 254COMMON

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000013678DD6CD7
_snprintf.LIBCMT ref: 0000013678DD6D02
_snprintf.LIBCMT ref: 0000013678DD6D1E
_snprintf.LIBCMT ref: 0000013678DD6DD3
_snprintf.LIBCMT ref: 0000013678DD6DEA

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID:
API String ID: 3512837008-0
Opcode ID: 97546a0ab56648f0e12b9c4261f5022597e73a89edba6ec666ef57aa91bfa1fd
Instruction ID: 228623ddeb1a04b14aee07386fa44eb0a0a524c48ed7ca65dfe38febbf716cff
Opcode Fuzzy Hash: 97546a0ab56648f0e12b9c4261f5022597e73a89edba6ec666ef57aa91bfa1fd
Instruction Fuzzy Hash: E691FB31118A489FEB55FF68E886BE9BBE5FB94304F50816AE446C3192DF34DE41CB81

Function 0000013678DE5BE4 Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000013678DE5C07

Part of subcall function 0000013678DE5E74: _FF_MSGBANNER.LIBCMT ref: 0000013678DE5EA4
Part of subcall function 0000013678DE5E74: _NMSG_WRITE.LIBCMT ref: 0000013678DE5EAE
Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5EE2
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EED
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EF8

malloc.LIBCMT ref: 0000013678DE5C15

Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5F08
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5F0D

malloc.LIBCMT ref: 0000013678DE5C37
_snprintf.LIBCMT ref: 0000013678DE5C52

Part of subcall function 0000013678DE622C: _errno.LIBCMT ref: 0000013678DE6263
Part of subcall function 0000013678DE622C: _invalid_parameter_noinfo.LIBCMT ref: 0000013678DE626E

malloc.LIBCMT ref: 0000013678DE5C6D

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 5cf36a0f46bdde7e2e607a114f81d07c702ff0cc7ddf641e62925f8ba8e7d262
Instruction ID: f867b78c5efee33a8639cab9546a2f20921a9f9228f40fdf2f1599d6fd7c5155
Opcode Fuzzy Hash: 5cf36a0f46bdde7e2e607a114f81d07c702ff0cc7ddf641e62925f8ba8e7d262
Instruction Fuzzy Hash: 2A11213161CF085FE798EB6CA446395BBE1E78C710F50465EE04AC3296DA349D4147D5

Function 0000013678DE721C Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000013678DE7254

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

_invalid_parameter_noinfo.LIBCMT ref: 0000013678DE725F
_flush.LIBCMT ref: 0000013678DE7311
_fileno.LIBCMT ref: 0000013678DE7332

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: fe3cbb59b92623254f31535bbcc3535ec3896c7653a338e87c95c01442f4d144
Instruction ID: 3c931efd35986e1d7ec65093fcaafb85ec72e545ec6d0a4e001c28823af95f93
Opcode Fuzzy Hash: fe3cbb59b92623254f31535bbcc3535ec3896c7653a338e87c95c01442f4d144
Instruction Fuzzy Hash: 46512C31218F091FE6E8995D54473B9FBC1E754318F94C26EE89AC31D6EA50DE424382

Function 0000013678DC90D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

clock.LIBCMT ref: 0000013678DC9117
clock.LIBCMT ref: 0000013678DC9124
clock.LIBCMT ref: 0000013678DC912D
clock.LIBCMT ref: 0000013678DC913A

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 1f39cef3506f56873464473c822950bba433c316edd6cd9574543658a040bd63
Instruction ID: 51048e5dea47330feb70276e8392bc26f80ea93f7d9a90ee8e769d287464762c
Opcode Fuzzy Hash: 1f39cef3506f56873464473c822950bba433c316edd6cd9574543658a040bd63
Instruction Fuzzy Hash: 05212E3340C7093EE764AD9894473B6BBD1E755354F15932EE896C3343F5509E4286C1

Function 0000013678DE6CDC Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 0000013678DE6CF9

Part of subcall function 0000013678DEB130: _FindPESection.LIBCMT ref: 0000013678DEB159

_initp_misc_cfltcvt_tab.LIBCMT ref: 0000013678DE6D0A
_initterm_e.LIBCMT ref: 0000013678DE6D1D
_IsNonwritableInCurrentImage.LIBCMT ref: 0000013678DE6D66

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable$FindSection_initp_misc_cfltcvt_tab_initterm_e
String ID:
API String ID: 1991439119-0
Opcode ID: cc5de2a5ab8d425de91fc795c60406dbd1dbe31fd1b87bcf1b4a8227761dc4fd
Instruction ID: f90134a551212e7b9ef281919cbee7de8ee180fcb9926d9db902999368940c0c
Opcode Fuzzy Hash: cc5de2a5ab8d425de91fc795c60406dbd1dbe31fd1b87bcf1b4a8227761dc4fd
Instruction Fuzzy Hash: 7F11CA33115A0D9AF74AEB60FC967EAB7A4F754308FC4852AD452D60E1EE389E44C744

Function 0000013678DE6450 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000013678DE64A1

Part of subcall function 0000013678DE8908: _getptd_noexit.LIBCMT ref: 0000013678DE890C

_invalid_parameter_noinfo.LIBCMT ref: 0000013678DE64AC

Strings

B, xrefs: 0000013678DE64D8

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction ID: bc492754f1ac6324c5a637efdf27f33416ca756577273bd5ad572364ae9f9971
Opcode Fuzzy Hash: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction Fuzzy Hash: 9711B231628A085FD754EF5894467A9BBD1FB98328F9043AEA059C32A1CB74C940C782

Function 0000013678DE193C Relevance: 5.2, APIs: 4, Instructions: 226COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000013678DE1970

Part of subcall function 0000013678DE5E74: _FF_MSGBANNER.LIBCMT ref: 0000013678DE5EA4
Part of subcall function 0000013678DE5E74: _NMSG_WRITE.LIBCMT ref: 0000013678DE5EAE
Part of subcall function 0000013678DE5E74: _callnewh.LIBCMT ref: 0000013678DE5EE2
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EED
Part of subcall function 0000013678DE5E74: _errno.LIBCMT ref: 0000013678DE5EF8

free.LIBCMT ref: 0000013678DE1AB7
free.LIBCMT ref: 0000013678DE1B1B
free.LIBCMT ref: 0000013678DE1B27

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: e25408eb960958c7e3879afad934e268323eef93c99906fc31d4779dc69f5fd0
Instruction ID: df7329488446addd7593969e64e5bb22f0384ea028ed87718c89bc04093d19d6
Opcode Fuzzy Hash: e25408eb960958c7e3879afad934e268323eef93c99906fc31d4779dc69f5fd0
Instruction Fuzzy Hash: 9E61C632318A085BEB69EB28D4437EDB7D1FB95314F904A5DE44AC32C7EE249E068781

Function 0000013678DCC300 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000013678DCC363

Memory Dump Source

Source File: 00000000.00000002.2754622278.0000013678DC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000013678DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13678dc0000_loaddll64.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0ec438b910e9f8ed57fb52a771f8cb7a2d564e7f60b966302d312431711d2172
Instruction ID: baf4bec9ebe450028e306fa6bbea20e39e5fba34c67df1e566169450298e69e2
Opcode Fuzzy Hash: 0ec438b910e9f8ed57fb52a771f8cb7a2d564e7f60b966302d312431711d2172
Instruction Fuzzy Hash: D851A53261CA055FDB58DF28D4866BA77D1FB84314F84966DE94BC3287EA30ED028685

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UxTheme.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_UxT_5fdac553aa43d04157a813c478cdafc56a856f_b52680da_6f5a37d7-5487-47c5-adc5-651ed76d0d82\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8203.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER82A1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER835D.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Windows Analysis Report
UxTheme.dll.dll