Edit tour

Windows Analysis Report
AvDJi40xp_9fyz7RPmKdbxb4.exe

Overview

General Information

Sample name:	AvDJi40xp_9fyz7RPmKdbxb4.exe
Analysis ID:	1468501
MD5:	b40b6b9bd2f7d17a65c72469ee2e2cfa
SHA1:	859ffdfda568b34e1c3ded9f846dea6e8774f5b5
SHA256:	f37f32eb1c859541773f55297fb1e05bbfc2874851fc7bbd4e185d3a6a1b6583
Tags:	exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

AvDJi40xp_9fyz7RPmKdbxb4.exe (PID: 7136 cmdline: "C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe" MD5: B40B6B9BD2F7D17A65C72469EE2E2CFA)

cmd.exe (PID: 5080 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qeuwztgf\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4340 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lfkidgdf.exe" C:\Windows\SysWOW64\qeuwztgf\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2496 cmdline: "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 3228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3156 cmdline: "C:\Windows\System32\sc.exe" description qeuwztgf "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 3548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6220 cmdline: "C:\Windows\System32\sc.exe" start qeuwztgf MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 6268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5808 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 1928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lfkidgdf.exe (PID: 2696 cmdline: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe" MD5: 1D7112211B0E3F7C2ED96B0897990451)

svchost.exe (PID: 4048 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.2160657446.0000000002AAD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4816:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.4192202050.0000000002862000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4e9e:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: AvDJi40xp_9fyz7RPmKdbxb4.exe PID: 7136	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: lfkidgdf.exe PID: 2696	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 4048	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.lfkidgdf.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.lfkidgdf.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.lfkidgdf.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.lfkidgdf.exe.3290000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.lfkidgdf.exe.3290000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.lfkidgdf.exe.3290000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
14.2.svchost.exe.2b00000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
14.2.svchost.exe.2b00000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
14.2.svchost.exe.2b00000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.lfkidgdf.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.lfkidgdf.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.lfkidgdf.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.lfkidgdf.exe.3290000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.lfkidgdf.exe.3290000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.lfkidgdf.exe.3290000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.3.lfkidgdf.exe.3120000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.3.lfkidgdf.exe.3120000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.lfkidgdf.exe.3120000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.3.lfkidgdf.exe.3120000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.lfkidgdf.exe.3120000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
14.2.svchost.exe.2b00000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
14.2.svchost.exe.2b00000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
14.2.svchost.exe.2b00000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.lfkidgdf.exe.2a70e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.lfkidgdf.exe.2a70e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.2.lfkidgdf.exe.2a70e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.lfkidgdf.exe.2a70e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.lfkidgdf.exe.2a70e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe", ParentImage: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, ParentProcessId: 2696, ParentProcessName: lfkidgdf.exe, ProcessCommandLine: svchost.exe, ProcessId: 4048, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe", ParentImage: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe, ParentProcessId: 7136, ParentProcessName: AvDJi40xp_9fyz7RPmKdbxb4.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2496, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.11.0, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 4048, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe", ParentImage: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, ParentProcessId: 2696, ParentProcessName: lfkidgdf.exe, ProcessCommandLine: svchost.exe, ProcessId: 4048, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 4048, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\qeuwztgf

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe", ParentImage: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe, ParentProcessId: 7136, ParentProcessName: AvDJi40xp_9fyz7RPmKdbxb4.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2496, ProcessName: sc.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: vanaheim.cn:443

Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for domain / URL

Source: jotunheim.name	Virustotal: Detection: 13%	Perma Link
Source: vanaheim.cn	Virustotal: Detection: 17%	Perma Link
Source: jotunheim.name:443	Virustotal: Detection: 12%	Perma Link
Source: vanaheim.cn:443	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for submitted file

Source: AvDJi40xp_9fyz7RPmKdbxb4.exe

Virustotal: Detection: 44%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\lfkidgdf.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: AvDJi40xp_9fyz7RPmKdbxb4.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Unpacked PE file: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Unpacked PE file: 11.2.lfkidgdf.exe.400000.0.unpack

Source: AvDJi40xp_9fyz7RPmKdbxb4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\qeuwztgf

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.94 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.133.13.231 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.75 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.53.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.251.173.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 80.66.75.11 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.11.0 52.101.11.0
Source: Joe Sandbox View	IP Address: 67.195.228.94 67.195.228.94
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 98.136.96.75 98.136.96.75

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: YAHOO-GQ1US YAHOO-GQ1US
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU
Source: Joe Sandbox View	ASN Name: AS-REGRU AS-REGRU
Source: Joe Sandbox View	ASN Name: YAHOO-NE1US YAHOO-NE1US

Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 52.101.11.0:25
Source: global traffic	TCP traffic: 192.168.2.4:58402 -> 98.136.96.75:25
Source: global traffic	TCP traffic: 192.168.2.4:58408 -> 142.251.173.26:25
Source: global traffic	TCP traffic: 192.168.2.4:58410 -> 217.69.139.150:25
Source: global traffic	TCP traffic: 192.168.2.4:58414 -> 104.47.53.36:25
Source: global traffic	TCP traffic: 192.168.2.4:58416 -> 67.195.228.94:25
Source: global traffic	TCP traffic: 192.168.2.4:58419 -> 94.100.180.31:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta6.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 50.23.12.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru
Source: global traffic	DNS traffic detected: DNS query: mta7.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: jotunheim.name

Source: unknown	Network traffic detected: HTTP traffic on port 58412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58409
Source: unknown	Network traffic detected: HTTP traffic on port 58409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58411
Source: unknown	Network traffic detected: HTTP traffic on port 58418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 11.2.lfkidgdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.3290000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.svchost.exe.2b00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.3290000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.lfkidgdf.exe.3120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.svchost.exe.2b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.2a70e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AvDJi40xp_9fyz7RPmKdbxb4.exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lfkidgdf.exe PID: 2696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4048, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.lfkidgdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.lfkidgdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.lfkidgdf.exe.3290000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.lfkidgdf.exe.3290000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 14.2.svchost.exe.2b00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 14.2.svchost.exe.2b00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.lfkidgdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.lfkidgdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.lfkidgdf.exe.3290000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.lfkidgdf.exe.3290000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.lfkidgdf.exe.3120000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.lfkidgdf.exe.3120000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.lfkidgdf.exe.3120000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.lfkidgdf.exe.3120000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 14.2.svchost.exe.2b00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 14.2.svchost.exe.2b00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.lfkidgdf.exe.2a70e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.lfkidgdf.exe.2a70e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.lfkidgdf.exe.2a70e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.lfkidgdf.exe.2a70e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.2160657446.0000000002AAD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.4192202050.0000000002862000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,LocalAlloc,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\qeuwztgf\

Jump to behavior

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Code function: 11_2_0040C913	11_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 14_2_02B0C913	14_2_02B0C913

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: String function: 029827AB appears 35 times

Source: AvDJi40xp_9fyz7RPmKdbxb4.exe, 00000000.00000002.4192106290.0000000002815000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesAtlassing0 vs AvDJi40xp_9fyz7RPmKdbxb4.exe
Source: AvDJi40xp_9fyz7RPmKdbxb4.exe, 00000000.00000002.4192222669.00000000028A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesAtlassing0 vs AvDJi40xp_9fyz7RPmKdbxb4.exe
Source: AvDJi40xp_9fyz7RPmKdbxb4.exe	Binary or memory string: OriginalFilenamesAtlassing0 vs AvDJi40xp_9fyz7RPmKdbxb4.exe

Source: AvDJi40xp_9fyz7RPmKdbxb4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.2.lfkidgdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.lfkidgdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.lfkidgdf.exe.3290000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.lfkidgdf.exe.3290000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 14.2.svchost.exe.2b00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 14.2.svchost.exe.2b00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.lfkidgdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.lfkidgdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.lfkidgdf.exe.3290000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.lfkidgdf.exe.3290000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.lfkidgdf.exe.3120000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.lfkidgdf.exe.3120000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.lfkidgdf.exe.3120000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.lfkidgdf.exe.3120000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 14.2.svchost.exe.2b00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 14.2.svchost.exe.2b00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.lfkidgdf.exe.2a70e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.lfkidgdf.exe.2a70e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.lfkidgdf.exe.2a70e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.lfkidgdf.exe.2a70e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.2160657446.0000000002AAD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.4192202050.0000000002862000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: AvDJi40xp_9fyz7RPmKdbxb4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@22/3@17/9

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_02866ECC CreateToolhelp32Snapshot,Module32First,

0_2_02866ECC

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 14_2_02B09A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	14_2_02B09A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3228:120:WilError_03

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

File created: C:\Users\user\AppData\Local\Temp\lfkidgdf.exe

Jump to behavior

Source: AvDJi40xp_9fyz7RPmKdbxb4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AvDJi40xp_9fyz7RPmKdbxb4.exe

Virustotal: Detection: 44%

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

File read: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Jump to behavior

Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_11-14845

Source: unknown	Process created: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe "C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe"
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qeuwztgf\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lfkidgdf.exe" C:\Windows\SysWOW64\qeuwztgf\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description qeuwztgf "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start qeuwztgf
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe"
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qeuwztgf\	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lfkidgdf.exe" C:\Windows\SysWOW64\qeuwztgf\	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description qeuwztgf "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start qeuwztgf	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: AvDJi40xp_9fyz7RPmKdbxb4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Unpacked PE file: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Unpacked PE file: 11.2.lfkidgdf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Unpacked PE file: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Unpacked PE file: 11.2.lfkidgdf.exe.400000.0.unpack

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: 0_2_0286A1B4 push 0000002Bh; iretd		0_2_0286A1BA
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Code function: 11_2_02AB4B2C push 0000002Bh; iretd		11_2_02AB4B32

Source: AvDJi40xp_9fyz7RPmKdbxb4.exe

Static PE information: section name: .text entropy: 7.709118323604979

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe (copy)			Jump to dropped file
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	File created: C:\Users\user\AppData\Local\Temp\lfkidgdf.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\qeuwztgf

Jump to behavior

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support"

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

14_2_02B0199C

Source: C:\Windows\SysWOW64\svchost.exe

Window / User API: threadDelayed 707

Jump to behavior

Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_11-15271
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15191
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_14-6989

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_14-6130

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-15139
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_11-15902
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_14-6420

Source: C:\Windows\SysWOW64\svchost.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_14-7409

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-14717
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_11-14861

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	API coverage: 6.1 %
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	API coverage: 4.5 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 6312	Thread sleep time: -34000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 6560	Thread sleep count: 707 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 6560	Thread sleep time: -707000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 6560	Thread sleep count: 173 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 6560	Thread sleep time: -173000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 0000000E.00000002.4191147601.0000000002E00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	API call chain: ExitProcess graph end node			graph_0-15151
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node			graph_14-6422

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_14-7655
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_11-16195

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: 0_2_028667A9 push dword ptr fs:[00000030h]	0_2_028667A9
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: 0_2_02980D90 mov eax, dword ptr fs:[00000030h]	0_2_02980D90
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: 0_2_0298092B mov eax, dword ptr fs:[00000030h]	0_2_0298092B
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Code function: 11_2_02A70D90 mov eax, dword ptr fs:[00000030h]	11_2_02A70D90
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Code function: 11_2_02A7092B mov eax, dword ptr fs:[00000030h]	11_2_02A7092B
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Code function: 11_2_02AB1121 push dword ptr fs:[00000030h]	11_2_02AB1121

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 14_2_02B09A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	14_2_02B09A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.94 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.133.13.231 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.75 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.53.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.251.173.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 80.66.75.11 443	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2B00000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B00000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B00000			Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2846008			Jump to behavior

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qeuwztgf\	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lfkidgdf.exe" C:\Windows\SysWOW64\qeuwztgf\	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description qeuwztgf "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start qeuwztgf	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

0_2_00407809

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,VirtualProtect,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 11.2.lfkidgdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.3290000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.svchost.exe.2b00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.3290000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.lfkidgdf.exe.3120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.svchost.exe.2b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.2a70e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AvDJi40xp_9fyz7RPmKdbxb4.exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lfkidgdf.exe PID: 2696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4048, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 11.2.lfkidgdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.2980e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.3290000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.AvDJi40xp_9fyz7RPmKdbxb4.exe.4460000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.svchost.exe.2b00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.3290000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.lfkidgdf.exe.3120000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AvDJi40xp_9fyz7RPmKdbxb4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.svchost.exe.2b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.lfkidgdf.exe.2a70e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AvDJi40xp_9fyz7RPmKdbxb4.exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lfkidgdf.exe PID: 2696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4048, type: MEMORYSTR

Source: C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe	Code function: 11_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	11_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 14_2_02B088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	14_2_02B088B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	22 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Masquerading	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	412 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AvDJi40xp_9fyz7RPmKdbxb4.exe	45%	Virustotal		Browse
AvDJi40xp_9fyz7RPmKdbxb4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\lfkidgdf.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
mta6.am0.yahoodns.net	1%	Virustotal	Browse
mxs.mail.ru	0%	Virustotal	Browse
mta7.am0.yahoodns.net	1%	Virustotal	Browse
jotunheim.name	14%	Virustotal	Browse
microsoft-com.mail.protection.outlook.com	0%	Virustotal	Browse
15.164.165.52.in-addr.arpa	1%	Virustotal	Browse
vanaheim.cn	17%	Virustotal	Browse
mail.ru	0%	Virustotal	Browse
smtp.google.com	0%	Virustotal	Browse
yahoo.com	0%	Virustotal	Browse
google.com	0%	Virustotal	Browse
50.23.12.20.in-addr.arpa	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
vanaheim.cn:443	100%	Avira URL Cloud	phishing
jotunheim.name:443	0%	Avira URL Cloud	safe
jotunheim.name:443	13%	Virustotal		Browse
vanaheim.cn:443	8%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mta6.am0.yahoodns.net	98.136.96.75	true	true	1%, Virustotal, Browse	unknown
mxs.mail.ru	217.69.139.150	true	true	0%, Virustotal, Browse	unknown
mta7.am0.yahoodns.net	67.195.228.94	true	true	1%, Virustotal, Browse	unknown
jotunheim.name	80.66.75.11	true	true	14%, Virustotal, Browse	unknown
microsoft-com.mail.protection.outlook.com	52.101.11.0	true	true	0%, Virustotal, Browse	unknown
vanaheim.cn	195.133.13.231	true	true	17%, Virustotal, Browse	unknown
smtp.google.com	142.251.173.26	true	false	0%, Virustotal, Browse	unknown
15.164.165.52.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown
google.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
yahoo.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
mail.ru	unknown	unknown	true	0%, Virustotal, Browse	unknown
50.23.12.20.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	8%, Virustotal, Browse Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.11.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
67.195.228.94	mta7.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	true
142.251.173.26	smtp.google.com	United States	15169	GOOGLEUS	false
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
195.133.13.231	vanaheim.cn	Russian Federation	197695	AS-REGRU	true
98.136.96.75	mta6.am0.yahoodns.net	United States	36646	YAHOO-NE1US	true
80.66.75.11	jotunheim.name	Russian Federation	20803	RISS-ASRU	true
94.100.180.31	unknown	Russian Federation	47764	MAILRU-ASMailRuRU	true
104.47.53.36	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1468501
Start date and time:	2024-07-06 09:06:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AvDJi40xp_9fyz7RPmKdbxb4.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@22/3@17/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 66 Number of non-executed functions: 249
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.112.250.133, 20.76.201.171, 20.70.246.20, 20.231.239.246, 20.236.44.162
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:08:09	API Interceptor	857x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.11.0	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.11678.1633.exe	Get hash	malicious	Tofsee	Browse
67.195.228.94	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	WtRLqa6ZXn.exe	Get hash	malicious	Unknown	Browse
	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	message.elm.exe	Get hash	malicious	Unknown	Browse
217.69.139.150	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse
	OWd39WUX3D.exe	Get hash	malicious	Pushdo	Browse
98.136.96.75	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	file.log.exe	Get hash	malicious	Unknown	Browse
	message.txt.exe	Get hash	malicious	Unknown	Browse
	ac492e6a204784df07ef3841b3ae1f8a68b349db90a34.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse
	readme.txt.exe	Get hash	malicious	Unknown	Browse
	Update-KB9504-x86.exe	Get hash	malicious	Unknown	Browse
	d5lcwbdDfu.exe	Get hash	malicious	Tofsee Xmrig	Browse
	sbFQSOHQS9.exe	Get hash	malicious	Tofsee Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta6.am0.yahoodns.net	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.72
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	67.195.228.109
	webcam.txt.com.exe	Get hash	malicious	Unknown	Browse	67.195.204.73
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.106
	file.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	.exe	Get hash	malicious	Unknown	Browse	98.136.96.91
mta7.am0.yahoodns.net	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	SecuriteInfo.com.Win32.BotX-gen.31335.5127.exe	Get hash	malicious	Tofsee	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.111
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.77
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	67.195.204.79
	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	newtpp.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.91
	7b8wRbnmKu.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
jotunheim.name	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	SecuriteInfo.com.Win32.BotX-gen.15544.10747.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	SecuriteInfo.com.Win32.BotX-gen.28812.11191.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	SecuriteInfo.com.Trojan.Siggen23.53341.25424.13682.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	kNFzCbNNpD.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
mxs.mail.ru	yq5xNPpWCT.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	94.100.180.31
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	94.100.180.31
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	217.69.139.150
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse	94.100.180.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAILRU-ASMailRuRU	http://ct31152.tw1.ru/	Get hash	malicious	Unknown	Browse	94.100.180.226
	http://cb00287.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	http://cv59800.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	https://cs13786.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	http://cf20871.tw1.ru/	Get hash	malicious	Unknown	Browse	5.61.23.11
	x64.nn.elf	Get hash	malicious	Mirai	Browse	128.140.169.91
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
YAHOO-NE1US	s4WsI8Qcm4.elf	Get hash	malicious	Mirai, Moobot	Browse	98.139.105.91
	NgAzrOQSgK.elf	Get hash	malicious	Mirai	Browse	98.139.7.69
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	V#U2550DEOS.EXE	Get hash	malicious	Brontok	Browse	74.6.231.20
	vylI38MZOn.elf	Get hash	malicious	Mirai	Browse	98.137.87.64
	https://www.canva.com/design/DAGDiia04Xg/_SQxN5BXpIl2RgDD44fATw/edit?utm_content=DAGDiia04Xg&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	98.137.155.8
	P5uKPY120j.elf	Get hash	malicious	Mirai	Browse	216.252.107.75
	806aab44-6c03-4577-a3c4-83aa13dc7875.tmp	Get hash	malicious	Unknown	Browse	98.137.155.8
	https://xsetlp3sattty7yhmls.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	74.6.231.20
MICROSOFT-CORP-MSN-AS-BLOCKUS	(No subject) (29).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.65.28
	arm5-20240706-0012.elf	Get hash	malicious	Mirai	Browse	20.18.255.130
	https://pub-fb608504b57048a1b1ca54c74dbf132d.r2.dev/ront.html?ccsend	Get hash	malicious	HTMLPhisher	Browse	20.76.252.24
	https://netorgft11417463-my.sharepoint.com/:o:/g/personal/miraxy_mlmfoodsusa_com/Ep2tW9OiVYhPtqAXFyRLSFoBWqPOojE29ja-FQWlUqv0SA?e=5%3algW4EA&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://bainbridgemfg-my.sharepoint.com/:o:/p/david/ErvlllHCJGpPobC1afGT7j4Badn5zob3qi0w_pRTIz-v-g?e=5%3a0L4XAf&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://starsof.com/404.php?7-797967704b536932307465765443334f7a4d6d73306b744f533948337a676e494439454841413d3d-amdyb3dAdG9sbGVzb25hei5vcmc=	Get hash	malicious	HTMLPhisher	Browse	13.74.129.92
	https://deacerousa2-my.sharepoint.com/:o:/g/personal/eservice_huynhlaw_com/Ekv2F9Kc_pJJuB-bxZ7Z5QcBrNuZWh85OaRkXp9nQSqCiQ?e=5%3aD7eLEH&at=9	Get hash	malicious	HTMLPhisher	Browse	52.107.242.226
	https://deacerousa2-my.sharepoint.com/:o:/g/personal/eservice_huynhlaw_com/Ekv2F9Kc_pJJuB-bxZ7Z5QcBrNuZWh85OaRkXp9nQSqCiQ?e=5%3aD7eLEH&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	Christy Towler shared _OmniSource Marketing Group_ with you.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	Christy Towler shared _OmniSource Marketing Group_ with you.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
AS-REGRU	Scan405.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	ScanPDF_102.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	TOgpmvvWoj.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	AuT5pFGTFw.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	new order.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	MUdeeReQ5R.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	nJ8mJTmMf0.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	Attendance list.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	XNP1BNVNqi.elf	Get hash	malicious	Mirai	Browse	80.78.252.5
	DHL Arrival Notice.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
YAHOO-GQ1US	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	https://yellatism.com/click.php?key=2240o76mk7oyoycyr074&cid=cphbldi9sch0sh7da130&zone=2353135-2517555085-3576986712&campaign=395161020&type=Push&age=11&creative_id=547520&campaign_id=108855&site_id=11517&placement_id=43113822&preset_id=500	Get hash	malicious	Unknown	Browse	98.137.11.164
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	GK9sEyIS4f.elf	Get hash	malicious	Mirai	Browse	98.136.201.234
	n6UMcur8v3.elf	Get hash	malicious	Mirai	Browse	98.137.238.181
	zGP5DlrwgZ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.137.103.190
	9g5gIOlb47.elf	Get hash	malicious	Mirai	Browse	98.139.117.88
	https://www.googleadservices.com/pagead/aclk?sa=L&ai=CEPSIY7k7Zpu1AY3rkPIP8q21mAvP_pi8d4PY85XiEsq6jPG-ARABIPT5xiVgyeaGi7ykoBqgAcCz_YIDyAEC4AIAqAMByAMIqgSdAk_QZfhjp8EKKRw8Ud-sac3T3jbhfjxjJ1sRhgU3SOjAuI5huqeTvemsIazylmO5A9WU45_edGutcUqL46MvuNtxU89a64S7xhljcSlyUs-dysnWLJ2j0jUpH_gKnco9owTuaX1dg-lH7IYSpQI3MKj-Dr00v1SC_8ZhuzoINVR1E2pcblzJpyD5_udwujRkOY3Fao0Lt8Mai9Sq-EbJfdXMijbwOeNV94FwcwlSMZ7he13IkHy_a1HexFAPvo5qqjQXKG7VuYCajYpF3q5URq0loIuDY5WXWNc5RPV77yzvPDM2ytOukuK76vBmfoFdcFIyWUc5xZIVsm9dr8SzjJNE1z63RwDOkXHpq4VxrPcl1gRfUlqaUGyYeMbOoMAEp9WvltcE4AQBiAWQgcDhTpAGAaAGAoAHqMyCfYgHAZAHAqgH2baxAqgH1ckbqAemvhuoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQKoB_jCsQKoB_vCsQLYBwHSCCcIABACGB0yAQA6Dp_QgICAgASAwICAgKAoSL39wTpYjsuajM3-hQOxCUbAF_v0mAHVgAoDmAsByAsBqg0CVVPIDQHiDRMIlf2ajM3-hQMVjTVECB3yVg2z2BMM0BUB-BYBgBcBshgJEgLeaBgCIgEA6BgB&ae=1&gclid=Cj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcB&num=1&cid=CAQSQwB7FLtqgUEuOym-5Tn68arUiPJ1jdwPgw46Y6zUHfAkI3hTIEhGQzVeYafsm9LBj6pxutwTRiLFJPhCq9OvYdD7CqQYAQ&sig=AOD64_2G4fRbd2sH1E5jnf1iXQS4SW_Q2g&client=ca-pub-6396844742497208&rf=5&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=2&adurl=https://browsingwithwave.com/%3Fsrc%3Dd-aff16-cp21142438032%26ob%3Dobgcobedobem%26dvc%3Dc%26k%3D%26crt%3D695418066867%26adp%3D%26plc%3D%26tgt%3D%26sl%3D%26cpd%3D21142438032%26iid%3Dwav%26gclid%3DCj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcB	Get hash	malicious	Unknown	Browse	98.136.144.138
	https://t.co/yKnQGIBNmn	Get hash	malicious	HTMLPhisher	Browse	74.6.160.138
	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94

Process:	C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12696064
Entropy (8bit):	5.50848535248732
Encrypted:	false
SSDEEP:	98304:xqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqS:
MD5:	1D7112211B0E3F7C2ED96B0897990451
SHA1:	FFE8C1DC7ADE2954699C86909142CF6BE5350313
SHA-256:	EDA4991615678D5147D4E63FE8519274C2563B68E38D4663EAFB47F27CF4BCCD
SHA-512:	FFDA3D463B1F7D8F89AFB089B198A7847F07AE95F535DADA604647E7278B0C01FDA18E213CDC046A2A4823AAFB90DE03DA65846F0C81DCE43F2093CAF6A5A235
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............yB.yB.yB...B.yB...B.yB...B..yB...B.yB.xB..yB...B.yB...B.yB...B.yBRich.yB................PE..L...577d.....................P@.....h%............@...........................B......;......................................<9.......PA..............................9...............................4..@............................................text...p........................... ..`.rdata..d2.......4..................@..@.data.....>..P.......6..............@....rsrc........PA....................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12696064
Entropy (8bit):	5.50848535248732
Encrypted:	false
SSDEEP:	98304:xqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqS:
MD5:	1D7112211B0E3F7C2ED96B0897990451
SHA1:	FFE8C1DC7ADE2954699C86909142CF6BE5350313
SHA-256:	EDA4991615678D5147D4E63FE8519274C2563B68E38D4663EAFB47F27CF4BCCD
SHA-512:	FFDA3D463B1F7D8F89AFB089B198A7847F07AE95F535DADA604647E7278B0C01FDA18E213CDC046A2A4823AAFB90DE03DA65846F0C81DCE43F2093CAF6A5A235
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............yB.yB.yB...B.yB...B.yB...B..yB...B.yB.xB..yB...B.yB...B.yB...B.yBRich.yB................PE..L...577d.....................P@.....h%............@...........................B......;......................................<9.......PA..............................9...............................4..@............................................text...p........................... ..`.rdata..d2.......4..................@..@.data.....>..P.......6..............@....rsrc........PA....................@..@........................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.314370004206929
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AvDJi40xp_9fyz7RPmKdbxb4.exe
File size:	235'008 bytes
MD5:	b40b6b9bd2f7d17a65c72469ee2e2cfa
SHA1:	859ffdfda568b34e1c3ded9f846dea6e8774f5b5
SHA256:	f37f32eb1c859541773f55297fb1e05bbfc2874851fc7bbd4e185d3a6a1b6583
SHA512:	7a4b7171000f8dad0eed766e212ee6c9ebf6431175291442524383232f5455f6bc3e8b224c31dc8bf48ad0cba4ef7637edd4dcc8f32e48f93fb9ea7036adeae1
SSDEEP:	3072:DI/quXXuYu/IdYKV97eRuWYxYBouZdSzBS7sy4iIb:DYqKXzEIzSbYxYTAS7W
TLSH:	5B34DF21B2E19431D47B453785F1FA60EA7ABC52B7F1912F23682A3F2EB07D18725316
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............yB..yB..yB...B..yB...B..yB...B..yB...B..yB..xB..yB...B..yB...B..yB...B..yBRich..yB................PE..L...577d...........

File Icon


Icon Hash:	63796de961636e0f

Static PE Info

General

Entrypoint:	0x402568
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64373735 [Wed Apr 12 22:56:53 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	48bfd2c8ba2c8c1adc16449871b198d1

Entrypoint Preview

Instruction
call 00007F1FD523C0F7h
jmp 00007F1FD523935Eh
push edi
mov eax, esi
and eax, 0Fh
test eax, eax
jne 00007F1FD5239597h
mov edx, ecx
and ecx, 7Fh
shr edx, 07h
je 00007F1FD5239537h
jmp 00007F1FD52394D8h
lea ebx, dword ptr [ebx+00000000h]
movdqa xmm0, dqword ptr [esi]
movdqa xmm1, dqword ptr [esi+10h]
movdqa xmm2, dqword ptr [esi+20h]
movdqa xmm3, dqword ptr [esi+30h]
movdqa dqword ptr [edi], xmm0
movdqa dqword ptr [edi+10h], xmm1
movdqa dqword ptr [edi+20h], xmm2
movdqa dqword ptr [edi+30h], xmm3
movdqa xmm4, dqword ptr [esi+40h]
movdqa xmm5, dqword ptr [esi+50h]
movdqa xmm6, dqword ptr [esi+60h]
movdqa xmm7, dqword ptr [esi+70h]
movdqa dqword ptr [edi+40h], xmm4
movdqa dqword ptr [edi+50h], xmm5
movdqa dqword ptr [edi+60h], xmm6
movdqa dqword ptr [edi+70h], xmm7
lea esi, dword ptr [esi+00000080h]
lea edi, dword ptr [edi+00000080h]
dec edx
jne 00007F1FD5239475h
test ecx, ecx
je 00007F1FD523951Bh
mov edx, ecx
shr edx, 04h
test edx, edx
je 00007F1FD52394E9h
lea ebx, dword ptr [ebx+00000000h]
movdqa xmm0, dqword ptr [esi]
movdqa dqword ptr [edi], xmm0
lea esi, dword ptr [esi+10h]
lea edi, dword ptr [edi+10h]
dec edx
jne 00007F1FD52394C1h
and ecx, 0Fh
je 00007F1FD52394F6h
mov eax, ecx
shr ecx, 02h
je 00007F1FD52394DFh
mov edx, dword ptr [esi]
mov dword ptr [edi], edx
lea esi, dword ptr [esi+04h]
lea edi, dword ptr [edi+04h]
dec ecx
jne 00007F1FD52394C5h
mov ecx, eax
and ecx, 00000000h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2393c	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2415000	0xaa80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x239dc	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23400	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x21000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1fd70	0x1fe00	f5b5e491efb8ad14df382794e6776642	False	0.8540517769607843	data	7.709118323604979	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x21000	0x3264	0x3400	dc624da186f5daab5640a9131c1c02cb	False	0.3528395432692308	data	4.875662859094191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x25000	0x23efea0	0xb400	b235bffcaa98db9eee9dbe7e6d7e3579	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2415000	0xaa80	0xac00	c848a5b0454368cd4816965a8c11e511	False	0.5316815043604651	data	5.479127369442671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x24153a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Japanese	Japan	0.5299539170506913
RT_ICON	0x2415a68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Japanese	Japan	0.4182572614107884
RT_ICON	0x2418010	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Japanese	Japan	0.45390070921985815
RT_ICON	0x24184a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Japanese	Japan	0.3997867803837953
RT_ICON	0x2419350	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Japanese	Japan	0.5816787003610109
RT_ICON	0x2419bf8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Japanese	Japan	0.646889400921659
RT_ICON	0x241a2c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Japanese	Japan	0.661849710982659
RT_ICON	0x241a828	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Japanese	Japan	0.5451244813278008
RT_ICON	0x241cdd0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Japanese	Japan	0.5970919324577861
RT_ICON	0x241de78	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Japanese	Japan	0.5713114754098361
RT_ICON	0x241e800	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Japanese	Japan	0.650709219858156
RT_STRING	0x241ef70	0x6c0	data	Japanese	Japan	0.42476851851851855
RT_STRING	0x241f630	0x23a	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Japanese	Japan	0.48947368421052634
RT_STRING	0x241f870	0x20e	data	Japanese	Japan	0.5057034220532319
RT_GROUP_ICON	0x2418478	0x30	data	Japanese	Japan	0.9375
RT_GROUP_ICON	0x241ec68	0x76	data	Japanese	Japan	0.6694915254237288
RT_VERSION	0x241ece0	0x290	MS Windows COFF PA-RISC object file			0.5274390243902439

Imports

DLL	Import
KERNEL32.dll	GetConsoleAliasesLengthW, SetEndOfFile, FindResourceW, CreateDirectoryW, WriteConsoleInputA, VirtualFree, GetWindowsDirectoryA, LoadLibraryW, ReplaceFileW, GetModuleFileNameW, GlobalUnlock, SetLastError, GetProcAddress, LoadLibraryA, IsBadStringPtrW, GlobalGetAtomNameW, EnumResourceTypesW, GetOEMCP, CancelIo, OpenFileMappingW, GetWindowsDirectoryW, RtlUnwind, Sleep, GetStringTypeW, LCMapStringW, RemoveVectoredExceptionHandler, FindResourceA, CreateFileA, LocalAlloc, GetDateFormatW, EnterCriticalSection, LeaveCriticalSection, GetLastError, HeapFree, HeapAlloc, MultiByteToWideChar, HeapReAlloc, GetCommandLineA, HeapSetInformation, GetStartupInfoW, IsProcessorFeaturePresent, RaiseException, HeapCreate, GetModuleHandleW, ExitProcess, DecodePointer, WriteFile, GetStdHandle, EncodePointer, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetCurrentThreadId, SetUnhandledExceptionFilter, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, UnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, HeapSize
USER32.dll	InsertMenuItemW, GetKeyboardLayoutNameW, GetCaretPos, SetMessageExtraInfo, CharUpperBuffW, DdeKeepStringHandle, GetClassInfoW
GDI32.dll	GetCharWidthW
ADVAPI32.dll	CopySid, BackupEventLogW
SHELL32.dll	FindExecutableA
ole32.dll	CoRevokeClassObject, CoMarshalHresult
WINHTTP.dll	WinHttpWriteData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Japanese	Japan

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2024 09:07:26.823124886 CEST	49731	25	192.168.2.4	52.101.11.0
Jul 6, 2024 09:07:27.908132076 CEST	49731	25	192.168.2.4	52.101.11.0
Jul 6, 2024 09:07:29.908129930 CEST	49731	25	192.168.2.4	52.101.11.0
Jul 6, 2024 09:07:30.033493042 CEST	49734	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:07:30.033518076 CEST	443	49734	195.133.13.231	192.168.2.4
Jul 6, 2024 09:07:30.033588886 CEST	49734	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:07:33.923743010 CEST	49731	25	192.168.2.4	52.101.11.0
Jul 6, 2024 09:07:41.923763037 CEST	49731	25	192.168.2.4	52.101.11.0
Jul 6, 2024 09:07:46.832237959 CEST	58402	25	192.168.2.4	98.136.96.75
Jul 6, 2024 09:07:47.892532110 CEST	58402	25	192.168.2.4	98.136.96.75
Jul 6, 2024 09:07:49.892699003 CEST	58402	25	192.168.2.4	98.136.96.75
Jul 6, 2024 09:07:53.892534971 CEST	58402	25	192.168.2.4	98.136.96.75
Jul 6, 2024 09:08:01.908209085 CEST	58402	25	192.168.2.4	98.136.96.75
Jul 6, 2024 09:08:06.863055944 CEST	58408	25	192.168.2.4	142.251.173.26
Jul 6, 2024 09:08:07.876934052 CEST	58408	25	192.168.2.4	142.251.173.26
Jul 6, 2024 09:08:09.876946926 CEST	58408	25	192.168.2.4	142.251.173.26
Jul 6, 2024 09:08:10.035496950 CEST	49734	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:08:10.035581112 CEST	443	49734	195.133.13.231	192.168.2.4
Jul 6, 2024 09:08:10.035702944 CEST	49734	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:08:10.296592951 CEST	58409	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:08:10.296613932 CEST	443	58409	195.133.13.231	192.168.2.4
Jul 6, 2024 09:08:10.296843052 CEST	58409	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:08:13.876966000 CEST	58408	25	192.168.2.4	142.251.173.26
Jul 6, 2024 09:08:21.892576933 CEST	58408	25	192.168.2.4	142.251.173.26
Jul 6, 2024 09:08:26.894571066 CEST	58410	25	192.168.2.4	217.69.139.150
Jul 6, 2024 09:08:27.892606974 CEST	58410	25	192.168.2.4	217.69.139.150
Jul 6, 2024 09:08:29.892726898 CEST	58410	25	192.168.2.4	217.69.139.150
Jul 6, 2024 09:08:33.892961025 CEST	58410	25	192.168.2.4	217.69.139.150
Jul 6, 2024 09:08:41.892604113 CEST	58410	25	192.168.2.4	217.69.139.150
Jul 6, 2024 09:08:50.283477068 CEST	58409	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:08:50.283565998 CEST	443	58409	195.133.13.231	192.168.2.4
Jul 6, 2024 09:08:50.283623934 CEST	58409	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:08:50.395740032 CEST	58411	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:08:50.395771980 CEST	443	58411	195.133.13.231	192.168.2.4
Jul 6, 2024 09:08:50.395838022 CEST	58411	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:09:30.392812014 CEST	58411	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:09:30.392901897 CEST	443	58411	195.133.13.231	192.168.2.4
Jul 6, 2024 09:09:30.392968893 CEST	58411	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:09:30.527815104 CEST	58412	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:09:30.527865887 CEST	443	58412	195.133.13.231	192.168.2.4
Jul 6, 2024 09:09:30.528054953 CEST	58412	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:09:53.633944988 CEST	58414	25	192.168.2.4	104.47.53.36
Jul 6, 2024 09:09:54.642785072 CEST	58414	25	192.168.2.4	104.47.53.36
Jul 6, 2024 09:09:56.658519983 CEST	58414	25	192.168.2.4	104.47.53.36
Jul 6, 2024 09:10:00.658432007 CEST	58414	25	192.168.2.4	104.47.53.36
Jul 6, 2024 09:10:08.673999071 CEST	58414	25	192.168.2.4	104.47.53.36
Jul 6, 2024 09:10:10.533494949 CEST	58412	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:10:10.533572912 CEST	443	58412	195.133.13.231	192.168.2.4
Jul 6, 2024 09:10:10.533646107 CEST	58412	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:10:10.643465996 CEST	58415	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:10:10.643501043 CEST	443	58415	195.133.13.231	192.168.2.4
Jul 6, 2024 09:10:10.643584967 CEST	58415	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:10:13.660056114 CEST	58416	25	192.168.2.4	67.195.228.94
Jul 6, 2024 09:10:14.674062014 CEST	58416	25	192.168.2.4	67.195.228.94
Jul 6, 2024 09:10:16.689766884 CEST	58416	25	192.168.2.4	67.195.228.94
Jul 6, 2024 09:10:20.689675093 CEST	58416	25	192.168.2.4	67.195.228.94
Jul 6, 2024 09:10:28.705327034 CEST	58416	25	192.168.2.4	67.195.228.94
Jul 6, 2024 09:10:33.682821989 CEST	58417	25	192.168.2.4	142.251.173.26
Jul 6, 2024 09:10:34.689682007 CEST	58417	25	192.168.2.4	142.251.173.26
Jul 6, 2024 09:10:36.689677000 CEST	58417	25	192.168.2.4	142.251.173.26
Jul 6, 2024 09:10:40.689682961 CEST	58417	25	192.168.2.4	142.251.173.26
Jul 6, 2024 09:10:48.689732075 CEST	58417	25	192.168.2.4	142.251.173.26
Jul 6, 2024 09:10:50.658696890 CEST	58415	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:10:50.658785105 CEST	443	58415	195.133.13.231	192.168.2.4
Jul 6, 2024 09:10:50.658843040 CEST	58415	443	192.168.2.4	195.133.13.231
Jul 6, 2024 09:10:50.777395964 CEST	58418	443	192.168.2.4	80.66.75.11
Jul 6, 2024 09:10:50.777440071 CEST	443	58418	80.66.75.11	192.168.2.4
Jul 6, 2024 09:10:50.777654886 CEST	58418	443	192.168.2.4	80.66.75.11
Jul 6, 2024 09:10:53.826019049 CEST	58419	25	192.168.2.4	94.100.180.31
Jul 6, 2024 09:10:54.830389023 CEST	58419	25	192.168.2.4	94.100.180.31
Jul 6, 2024 09:10:56.845967054 CEST	58419	25	192.168.2.4	94.100.180.31
Jul 6, 2024 09:11:00.861612082 CEST	58419	25	192.168.2.4	94.100.180.31
Jul 6, 2024 09:11:08.861622095 CEST	58419	25	192.168.2.4	94.100.180.31

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2024 09:07:26.814307928 CEST	63470	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:07:26.822060108 CEST	53	63470	1.1.1.1	192.168.2.4
Jul 6, 2024 09:07:29.847974062 CEST	65319	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:07:29.949486017 CEST	53	65319	1.1.1.1	192.168.2.4
Jul 6, 2024 09:07:46.605709076 CEST	53	60752	162.159.36.2	192.168.2.4
Jul 6, 2024 09:07:46.815073967 CEST	63612	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:07:46.821835995 CEST	53	63612	1.1.1.1	192.168.2.4
Jul 6, 2024 09:07:46.822587967 CEST	62200	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:07:46.831470966 CEST	53	62200	1.1.1.1	192.168.2.4
Jul 6, 2024 09:07:47.097781897 CEST	58980	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:07:47.104604006 CEST	53	58980	1.1.1.1	192.168.2.4
Jul 6, 2024 09:07:58.092180014 CEST	55243	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:07:58.099659920 CEST	53	55243	1.1.1.1	192.168.2.4
Jul 6, 2024 09:08:06.846370935 CEST	65114	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:08:06.854034901 CEST	53	65114	1.1.1.1	192.168.2.4
Jul 6, 2024 09:08:06.854772091 CEST	65092	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:08:06.862607002 CEST	53	65092	1.1.1.1	192.168.2.4
Jul 6, 2024 09:08:10.143599987 CEST	53868	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:08:10.295814037 CEST	53	53868	1.1.1.1	192.168.2.4
Jul 6, 2024 09:08:26.877829075 CEST	57976	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:08:26.885570049 CEST	53	57976	1.1.1.1	192.168.2.4
Jul 6, 2024 09:08:26.886821032 CEST	52364	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:08:26.894076109 CEST	53	52364	1.1.1.1	192.168.2.4
Jul 6, 2024 09:09:53.381567955 CEST	52445	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:09:53.630542994 CEST	53	52445	1.1.1.1	192.168.2.4
Jul 6, 2024 09:10:13.643323898 CEST	52756	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:10:13.650563002 CEST	53	52756	1.1.1.1	192.168.2.4
Jul 6, 2024 09:10:13.651390076 CEST	55162	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:10:13.658704042 CEST	53	55162	1.1.1.1	192.168.2.4
Jul 6, 2024 09:10:33.674823046 CEST	56136	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:10:33.682007074 CEST	53	56136	1.1.1.1	192.168.2.4
Jul 6, 2024 09:10:50.769082069 CEST	54089	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:10:50.776566982 CEST	53	54089	1.1.1.1	192.168.2.4
Jul 6, 2024 09:10:53.675098896 CEST	62069	53	192.168.2.4	1.1.1.1
Jul 6, 2024 09:10:53.825036049 CEST	53	62069	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 6, 2024 09:07:26.814307928 CEST	192.168.2.4	1.1.1.1	0x645b	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:29.847974062 CEST	192.168.2.4	1.1.1.1	0x93a0	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:46.815073967 CEST	192.168.2.4	1.1.1.1	0xf78a	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:07:46.822587967 CEST	192.168.2.4	1.1.1.1	0x6477	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:47.097781897 CEST	192.168.2.4	1.1.1.1	0xb5a3	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jul 6, 2024 09:07:58.092180014 CEST	192.168.2.4	1.1.1.1	0xa162	Standard query (0)	50.23.12.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jul 6, 2024 09:08:06.846370935 CEST	192.168.2.4	1.1.1.1	0x2ab3	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:08:06.854772091 CEST	192.168.2.4	1.1.1.1	0x541	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:08:10.143599987 CEST	192.168.2.4	1.1.1.1	0xa3c7	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:08:26.877829075 CEST	192.168.2.4	1.1.1.1	0x122e	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:08:26.886821032 CEST	192.168.2.4	1.1.1.1	0x9e6f	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:09:53.381567955 CEST	192.168.2.4	1.1.1.1	0xd339	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:13.643323898 CEST	192.168.2.4	1.1.1.1	0x3656	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:10:13.651390076 CEST	192.168.2.4	1.1.1.1	0x12f8	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:33.674823046 CEST	192.168.2.4	1.1.1.1	0x460a	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:10:50.769082069 CEST	192.168.2.4	1.1.1.1	0x8d8b	Standard query (0)	jotunheim.name	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:53.675098896 CEST	192.168.2.4	1.1.1.1	0xf2dc	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 6, 2024 09:07:26.822060108 CEST	1.1.1.1	192.168.2.4	0x645b	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.11.0	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:26.822060108 CEST	1.1.1.1	192.168.2.4	0x645b	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.8.49	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:26.822060108 CEST	1.1.1.1	192.168.2.4	0x645b	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.42.0	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:26.822060108 CEST	1.1.1.1	192.168.2.4	0x645b	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.40.26	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:29.949486017 CEST	1.1.1.1	192.168.2.4	0x93a0	No error (0)	vanaheim.cn		195.133.13.231	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:46.821835995 CEST	1.1.1.1	192.168.2.4	0xf78a	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:07:46.821835995 CEST	1.1.1.1	192.168.2.4	0xf78a	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:07:46.821835995 CEST	1.1.1.1	192.168.2.4	0xf78a	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:07:46.831470966 CEST	1.1.1.1	192.168.2.4	0x6477	No error (0)	mta6.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:46.831470966 CEST	1.1.1.1	192.168.2.4	0x6477	No error (0)	mta6.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:46.831470966 CEST	1.1.1.1	192.168.2.4	0x6477	No error (0)	mta6.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:46.831470966 CEST	1.1.1.1	192.168.2.4	0x6477	No error (0)	mta6.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:46.831470966 CEST	1.1.1.1	192.168.2.4	0x6477	No error (0)	mta6.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:46.831470966 CEST	1.1.1.1	192.168.2.4	0x6477	No error (0)	mta6.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:46.831470966 CEST	1.1.1.1	192.168.2.4	0x6477	No error (0)	mta6.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:46.831470966 CEST	1.1.1.1	192.168.2.4	0x6477	No error (0)	mta6.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:07:47.104604006 CEST	1.1.1.1	192.168.2.4	0xb5a3	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jul 6, 2024 09:07:58.099659920 CEST	1.1.1.1	192.168.2.4	0xa162	Name error (3)	50.23.12.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jul 6, 2024 09:08:06.854034901 CEST	1.1.1.1	192.168.2.4	0x2ab3	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:08:06.862607002 CEST	1.1.1.1	192.168.2.4	0x541	No error (0)	smtp.google.com		142.251.173.26	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:08:06.862607002 CEST	1.1.1.1	192.168.2.4	0x541	No error (0)	smtp.google.com		64.233.184.26	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:08:06.862607002 CEST	1.1.1.1	192.168.2.4	0x541	No error (0)	smtp.google.com		64.233.184.27	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:08:06.862607002 CEST	1.1.1.1	192.168.2.4	0x541	No error (0)	smtp.google.com		142.251.173.27	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:08:06.862607002 CEST	1.1.1.1	192.168.2.4	0x541	No error (0)	smtp.google.com		74.125.206.27	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:08:10.295814037 CEST	1.1.1.1	192.168.2.4	0xa3c7	No error (0)	vanaheim.cn		195.133.13.231	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:08:26.885570049 CEST	1.1.1.1	192.168.2.4	0x122e	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:08:26.894076109 CEST	1.1.1.1	192.168.2.4	0x9e6f	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:08:26.894076109 CEST	1.1.1.1	192.168.2.4	0x9e6f	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:09:53.630542994 CEST	1.1.1.1	192.168.2.4	0xd339	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:09:53.630542994 CEST	1.1.1.1	192.168.2.4	0xd339	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:13.650563002 CEST	1.1.1.1	192.168.2.4	0x3656	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:10:13.650563002 CEST	1.1.1.1	192.168.2.4	0x3656	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:10:13.650563002 CEST	1.1.1.1	192.168.2.4	0x3656	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:10:13.658704042 CEST	1.1.1.1	192.168.2.4	0x12f8	No error (0)	mta7.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:13.658704042 CEST	1.1.1.1	192.168.2.4	0x12f8	No error (0)	mta7.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:13.658704042 CEST	1.1.1.1	192.168.2.4	0x12f8	No error (0)	mta7.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:13.658704042 CEST	1.1.1.1	192.168.2.4	0x12f8	No error (0)	mta7.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:13.658704042 CEST	1.1.1.1	192.168.2.4	0x12f8	No error (0)	mta7.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:13.658704042 CEST	1.1.1.1	192.168.2.4	0x12f8	No error (0)	mta7.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:13.658704042 CEST	1.1.1.1	192.168.2.4	0x12f8	No error (0)	mta7.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:13.658704042 CEST	1.1.1.1	192.168.2.4	0x12f8	No error (0)	mta7.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:33.682007074 CEST	1.1.1.1	192.168.2.4	0x460a	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:10:50.776566982 CEST	1.1.1.1	192.168.2.4	0x8d8b	No error (0)	jotunheim.name		80.66.75.11	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:53.825036049 CEST	1.1.1.1	192.168.2.4	0xf2dc	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:10:53.825036049 CEST	1.1.1.1	192.168.2.4	0xf2dc	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:07:02
Start date:	06/07/2024
Path:	C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe"
Imagebase:	0x400000
File size:	235'008 bytes
MD5 hash:	B40B6B9BD2F7D17A65C72469EE2E2CFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.4192202050.0000000002862000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.1770605242.0000000004460000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	03:07:06
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qeuwztgf\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:07:06
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:07:07
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lfkidgdf.exe" C:\Windows\SysWOW64\qeuwztgf\
Imagebase:	0x7ff7699e0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:07:07
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:07:07
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create qeuwztgf binPath= "C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d\"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0x6d0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:07:08
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:07:08
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description qeuwztgf "wifi internet conection"
Imagebase:	0x6d0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:07:08
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:07:09
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start qeuwztgf
Imagebase:	0x6d0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:07:09
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:07:09
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe /d"C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe"
Imagebase:	0x400000
File size:	12'696'064 bytes
MD5 hash:	1D7112211B0E3F7C2ED96B0897990451
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.2160657446.0000000002AAD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.2160785378.0000000003290000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000003.1856330126.0000000003120000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:07:09
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:07:09
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:07:15
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x730000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	2.2%
Signature Coverage:	24.9%
Total number of Nodes:	1529
Total number of Limit Nodes:	19

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 0040A189
%X%08X, xrefs: 0040A0B0
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 00409EDB
D, xrefs: 00409F8E
\, xrefs: 00409D0C
", xrefs: 0040A078
P, xrefs: 00409DAA

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 408deff44febd3916874fa53db5e5f0dd1b788e316581794cedda39bc3a0aab8
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 408deff44febd3916874fa53db5e5f0dd1b788e316581794cedda39bc3a0aab8
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: fb32ede88c892ccab39cf83d003fcbea33a4e2e8563a4575a47fd59e5a1c2ade
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: fb32ede88c892ccab39cf83d003fcbea33a4e2e8563a4575a47fd59e5a1c2ade
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 4febc6132cbb2eeae90f99f22907b6d3a51082cd0e0b87a57774915eab482f02
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 4febc6132cbb2eeae90f99f22907b6d3a51082cd0e0b87a57774915eab482f02
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 02866ECC Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02866EF4
Module32First.KERNEL32(00000000,00000224), ref: 02866F14

Memory Dump Source

Source File: 00000000.00000002.4192202050.0000000002862000.00000040.00000020.00020000.00000000.sdmp, Offset: 02862000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2862000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9f2a4635cddba74349cffded1e363938ad31ff4a3ef0ca7e8d91655badf55186
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7EF0963D5007616FD7203BF9A88DB7E77ECAF49725F100528E646D54C0EB74E8454A61

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 618cfb6f1b26c540220dcc2678a44076c62346fd56d5638b59146fa8fa35b1d5
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 618cfb6f1b26c540220dcc2678a44076c62346fd56d5638b59146fa8fa35b1d5
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: e164254f3378dd396073a59d5f8bf438da5901e9f91fe2d8a4805c76184d12e6
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: e164254f3378dd396073a59d5f8bf438da5901e9f91fe2d8a4805c76184d12e6
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 0298003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0298024D

Strings

kernel32.dll, xrefs: 0298008F, 02980095
cess, xrefs: 0298018D

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: d0e53b61273531ab38d23d50d51d9cc8c68263f388c43a8471df4b22a4e75715
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: C8526A75A01229DFDB64DF58C984BACBBB5BF09304F1480D9E94DAB351DB30AA89CF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: addf51b803be8b3fdc0b349711ac0ded489e61cd96ba8191abdedb398079e53a
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: addf51b803be8b3fdc0b349711ac0ded489e61cd96ba8191abdedb398079e53a
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 0dc9418032d7fae7e99f7ff6decd2e171138db246ccd5078cf7f6b69033b9994
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 0dc9418032d7fae7e99f7ff6decd2e171138db246ccd5078cf7f6b69033b9994
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 02980E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02980223,?,?), ref: 02980E19
SetErrorMode.KERNELBASE(00000000,?,?,02980223,?,?), ref: 02980E1E

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: e98cf138215984ae1e55f3103e4fc895c4da1c76603ef34e550f029b5c5f42b1
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 55D0123214512877D7003A94DC09BCE7B1CDF05B66F048011FB0DDA081C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 02866B8B Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02866BDC

Memory Dump Source

Source File: 00000000.00000002.4192202050.0000000002862000.00000040.00000020.00020000.00000000.sdmp, Offset: 02862000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2862000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 39e1d1f51ed5c99b67b0903a4cd4e17f264bac884ee95d620cae671ca470a0ed
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 8A113C79A00248EFDB01DF98C989E98BBF5EF08351F158094F9489B361E375EA90DF80

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1394filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

\, xrefs: 0040D3A7
4, xrefs: 0040D9F7
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
drivers\, xrefs: 0040D067
@, xrefs: 0040D754
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
wtm_r, xrefs: 0040C97F
.sys, xrefs: 0040D0CC
flags_upd, xrefs: 0040CE4A
wtm_w, xrefs: 0040C96C
local_time, xrefs: 0040CACD
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
lid_file_upd, xrefs: 0040CE6A
wtm_c, xrefs: 0040C956
srv_time, xrefs: 0040CABB
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
\, xrefs: 0040D39D

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 58c16bf96f04c64393462683c7350eaf522ff62be46463dd462b2a21f2a14f1c
Instruction ID: e3e311afffee0f8fdcefab3b6ad12dcdc3eb324b3d868ccf40e5e7320ccd552c
Opcode Fuzzy Hash: 58c16bf96f04c64393462683c7350eaf522ff62be46463dd462b2a21f2a14f1c
Instruction Fuzzy Hash: BDB2C471D00209BBEB209FA4DD85FEA7BB9AB08304F14457BF505B22D1D7789A89CB5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtClose, xrefs: 004011B4
RtlFreeSid, xrefs: 00401116
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtFilterToken, xrefs: 0040122B
RtlNtStatusToDosError, xrefs: 00401194
RtlSetLastWin32Error, xrefs: 004010D6
ntdll.dll, xrefs: 0040100D
RtlLengthSid, xrefs: 00401246
NtDuplicateToken, xrefs: 004011F3
NtSetInformationThread, xrefs: 00401155
RtlInitUnicodeString, xrefs: 00401135
NtOpenProcessToken, xrefs: 004011D4
NtQueryInformationToken, xrefs: 00401262
NtTerminateProcess, xrefs: 004010F6
NtSetInformationToken, xrefs: 00401175

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: def56848a29238af3b3263ec016d123599b8ce3514d2c8bce6aae186bf62253e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: def56848a29238af3b3263ec016d123599b8ce3514d2c8bce6aae186bf62253e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Aug, xrefs: 0040B287
Fri, xrefs: 0040B248
Jun, xrefs: 0040B279
Sat, xrefs: 0040B24F
Sep, xrefs: 0040B28E
Feb, xrefs: 0040B25D
Sun, xrefs: 0040B225
Dec, xrefs: 0040B2A3
Mar, xrefs: 0040B264
Thu, xrefs: 0040B241
Jul, xrefs: 0040B280
Jan, xrefs: 0040B256
May, xrefs: 0040B272
Oct, xrefs: 0040B295
Nov, xrefs: 0040B29C
Tue, xrefs: 0040B233
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Apr, xrefs: 0040B26B
Mon, xrefs: 0040B22C
Wed, xrefs: 0040B23A

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 9c254f7c2f4551e4858b08560ebcfb375181b6b247abdacfd65a4178375c92cf
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: 9c254f7c2f4551e4858b08560ebcfb375181b6b247abdacfd65a4178375c92cf
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 93d2068cc19732fe8ad9ae0a9f51e86421eb0c8fa32be1230cd8688bd4bd79d5
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: 93d2068cc19732fe8ad9ae0a9f51e86421eb0c8fa32be1230cd8688bd4bd79d5
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

, xrefs: 00401462
D, xrefs: 004015C6
<, xrefs: 00401378
wusa.exe, xrefs: 00401388
%systemroot%\system32\cmd.exe, xrefs: 00401316
uac, xrefs: 00401628
PDu, xrefs: 0040139A
@, xrefs: 00401380
useless, xrefs: 0040161E

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 4a22ad167bc3991e7243980079933dba70382744969d1905516b1f864c22465e
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 4a22ad167bc3991e7243980079933dba70382744969d1905516b1f864c22465e
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

IsWow64Process, xrefs: 00401DF2
kernel32, xrefs: 00401DF7
start_srv, xrefs: 00401E6C
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
work_srv, xrefs: 00401E5E
born_date, xrefs: 00401EAD, 00401ECC
lid_file_upd, xrefs: 00401E25
loader_id, xrefs: 00401F4B, 00401F6B
net_type, xrefs: 00401E87
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 5dd434fdf3d1b2f7ac71eae5deaa1b81d7ffa9032da077e8e99a06cc7be058a2
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: 5dd434fdf3d1b2f7ac71eae5deaa1b81d7ffa9032da077e8e99a06cc7be058a2
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 029865E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 029865F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02986610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02986631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02986652

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 0c763e3340dbe245014b495ac6743b99c0108932068062114b68d1534d053823
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 05117371600258BFDB21AF65DC4AF9B3FACEB457A5F144025FA09EB250D7B1DD00CAA4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: ee9ff6285cd0759b386b71dc2009f55f092fb3ff13d227db5bcc73c144141d81
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: ee9ff6285cd0759b386b71dc2009f55f092fb3ff13d227db5bcc73c144141d81
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 7316c1f4b5cb1443490bb148765e0df43b8208094f0d347aba08efc86f487165
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 7316c1f4b5cb1443490bb148765e0df43b8208094f0d347aba08efc86f487165
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 0298092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0298095F
GetProcAddress., xrefs: 029809DC, 029809DF, 029809E4
l, xrefs: 02980966

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 488b4022198aa4651f638e99ebaa8a55008006827a595e62bcf7bdb05664b739
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: FC314AB6900609DFDB10DF99C884AAEBBF9FF48324F19404AD841A7310D771EA49CFA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 028667A9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4192202050.0000000002862000.00000040.00000020.00020000.00000000.sdmp, Offset: 02862000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2862000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 8c90030a31736e2950e3e7a0a61774bf8f6483ba16504c43a59877f9bc7c4a1d
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 1011A07A3401149FD750CE59DC85EA273EEEB88324B198165ED08CB301E679E802CBA0

Function 02980D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: c176cecf7dc77b31e62276bd5a420531f2e71618bfb76963a37a33887fc5f77e
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: D301A7776116048FDF21DF24C805BAB33E9FF85315F4944A5D906DB242E774A9458B90

Function 02989EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02989E6D
lstrcpy.KERNEL32(?,00000000), ref: 02989FE1
lstrcat.KERNEL32(?,?), ref: 02989FF2
lstrcat.KERNEL32(?,0041070C), ref: 0298A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0298A054
DeleteFileA.KERNEL32(?), ref: 0298A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0298A0D6
lstrcpy.KERNEL32 ref: 0298A12F
lstrlen.KERNEL32(00000022), ref: 0298A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 02989F13

Part of subcall function 02987029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02987081

Part of subcall function 02986F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\iwmorlyx,02987043), ref: 02986F4E
Part of subcall function 02986F30: GetProcAddress.KERNEL32(00000000), ref: 02986F55
Part of subcall function 02986F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02986F7B
Part of subcall function 02986F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02986F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0298A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0298A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0298A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0298A21B
GetDriveTypeA.KERNEL32(?), ref: 0298A265
lstrcat.KERNEL32(?,00000000), ref: 0298A29F
lstrcat.KERNEL32(?,00410A34), ref: 0298A2C5
lstrcat.KERNEL32(?,00000022), ref: 0298A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0298A2F4
wsprintfA.USER32 ref: 0298A31D
lstrcat.KERNEL32(?,00000000), ref: 0298A345
lstrcat.KERNEL32(?,?), ref: 0298A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0298A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0298A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0298A1D1

Part of subcall function 02989966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0298999D
Part of subcall function 02989966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 029899BD
Part of subcall function 02989966: RegCloseKey.ADVAPI32(?), ref: 029899C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0298A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0298A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0298A41D

Strings

", xrefs: 0298A2DF
D, xrefs: 0298A1F5
P, xrefs: 0298A011
", xrefs: 0298A142
\, xrefs: 02989F73
", xrefs: 0298A3F0

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: d0369e3d69d4c442e1d11acb2612fd768eda9bbdb98bf8f87f5bf6f884fdd897
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: BDF141B1D40259AFDF21EFA0CC48FEF7BBCAB09304F0844A6E605E2141E7759A858F65

Function 02987CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02987D21
GetUserNameA.ADVAPI32(?,?), ref: 02987D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02987D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02987DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02987DC0
EqualSid.ADVAPI32(?,?), ref: 02987DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 02987DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02987DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02987E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02987E12
LocalFree.KERNEL32(00000000), ref: 02987E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02987E35

Strings

PromptOnSecureDesktop, xrefs: 02987FA0
D, xrefs: 02987D73

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 76d805b6606c0fff8c4fbc6bde1f7db50c91485f730b2a8ae65ae9dddd423eed
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: B6A18B76900219AFDB11EFA1DC88FEEBBBDFB08304F18816AF501E6150D7758A84CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: eb1a08a2c71bfc4e71cb34ece599553e47f8ddafd4bc37f5bbc1e22e926e6740
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: eb1a08a2c71bfc4e71cb34ece599553e47f8ddafd4bc37f5bbc1e22e926e6740
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

except_info, xrefs: 00406728
Jan 13 2018, xrefs: 0040653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
plgs:, xrefs: 004066AA
%d=%p, xrefs: 004066F9
localcfg, xrefs: 0040672D
va=%08X%08X uef=%p, xrefs: 00406595

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 61f8b68dd9f344f506cfc8e29852887e470a3443c6047e34725b67e0d060e89d
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: 61f8b68dd9f344f506cfc8e29852887e470a3443c6047e34725b67e0d060e89d
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Incorrect respons, xrefs: 0040AB39
quit, xrefs: 0040A86C
., xrefs: 0040A8CA
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
rcpt to:<%s>, xrefs: 0040A855
mail from:<%s>, xrefs: 0040A848
AUTH LOGIN, xrefs: 0040A80C
helo %s, xrefs: 0040A803
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ESMTP, xrefs: 0040AA38
data, xrefs: 0040A85E
Too small respons, xrefs: 0040A9C9
localcfg, xrefs: 0040AB0B
ehlo %s, xrefs: 0040A7F5

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ae3e940a4bde8c590484db18a6dae5c4a8b1995a6f5a2f6c6eb5761f3b661a67
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ae3e940a4bde8c590484db18a6dae5c4a8b1995a6f5a2f6c6eb5761f3b661a67
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 02987A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02987A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02987ACD
GetLengthSid.ADVAPI32(?), ref: 02987ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02987B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02987B1F
EqualSid.ADVAPI32(?,?), ref: 02987B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 02987B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02987B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02987B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02987B77
LocalFree.KERNEL32(00000000), ref: 02987B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02987B9A
GetAce.ADVAPI32(?,?,?), ref: 02987BCA
EqualSid.ADVAPI32(?,?), ref: 02987BF1
DeleteAce.ADVAPI32(?,?), ref: 02987C0A
EqualSid.ADVAPI32(?,?), ref: 02987C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 02987CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02987CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02987CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02987CE0
LocalFree.KERNEL32(00000000), ref: 02987CEE

Strings

D, xrefs: 02987AC3

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 3a8dc46297b4854b18bccf73160a4d53bf114eafac54648786345e5346d527bb
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 73814C76900219AFDB11DFE4DD84FEEBBBCAF08344F18806AE605E7250D7759641CB64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: 96b744c21c97554fe267b79c97f5d976ed6b4de3d9a18d44cb0f3305665f7017
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 96b744c21c97554fe267b79c97f5d976ed6b4de3d9a18d44cb0f3305665f7017
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetAdaptersInfo, xrefs: 004019DC
Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4
GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: c2d043fcc5cbb47ed0bea78f2b79b5e209498882ff798d96aae41c0d31e4dbc2
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: c2d043fcc5cbb47ed0bea78f2b79b5e209498882ff798d96aae41c0d31e4dbc2
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 0298858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0298865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0298867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 029886A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 029886B1

Strings

", xrefs: 0298896C
PromptOnSecureDesktop, xrefs: 029885B6, 02988645, 029886BD, 02988708, 029887C5, 02988812, 029888E9, 02988905

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 92511189810587cf600e6e47cfbaca23a1183b074b3741ec12841c62e188c598
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: D2C1B1B290024DBEEB11BBA4DD84EEF7BBDFB44304F584065F605E2050E7B18A948B75

Function 029814E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02981601
lstrlenW.KERNEL32(-00000003), ref: 029817D8

Strings

<, xrefs: 029815DF
D, xrefs: 0298182D
, xrefs: 029816C9
@, xrefs: 029815E7

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 1ef9c4d308254240fea51449a980586c9f8ebcb2d13c4ce4c598b7de852a2150
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 38F1ADB11083419FD720EF64D888BABB7E9FB88304F04892DF69A97390D7B4D945CB56

Function 02987666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 029876D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02987757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0298778F
___ascii_stricmp.LIBCMT ref: 029878B4
RegCloseKey.ADVAPI32(?), ref: 0298794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0298796D
RegCloseKey.ADVAPI32(?), ref: 0298797E
RegCloseKey.ADVAPI32(?), ref: 029879AC
RegCloseKey.ADVAPI32(?), ref: 02987A56

Part of subcall function 0298F40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,0298772A,?), ref: 0298F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 029879F6
RegCloseKey.ADVAPI32(?), ref: 02987A4D

Strings

", xrefs: 02987800
PromptOnSecureDesktop, xrefs: 029876C5, 029876CA, 029876E5, 02987782, 029877E6, 02987862, 0298787B, 029879C2

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 2a5a49a272c00fe15648ff6b7c878870d45123ebbbc9c3f790ba595c972d9ade
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: A0C17176900219AFDB11AFE4DC44FEEBBBDEF49310F2840A5E544E6190EB75DA84CB60

Function 02982CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02982CED
socket.WS2_32(00000002,00000002,00000011), ref: 02982D07
htons.WS2_32(00000000), ref: 02982D42
select.WS2_32 ref: 02982D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 02982DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02982E62

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: a8e11deecb0bfc239dd99d8f6af7af23603db694b16913f413e32f54a9283ead
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: FB61C272904345AFC320AF64DC08B6BBBE8EF88755F084819FD8497151D7B5D880CBA9

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 5cd659d1eb2281404cf1ff7fe35be06c0bda1c6b56bcdef19fd154bc71bc5665
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: 5cd659d1eb2281404cf1ff7fe35be06c0bda1c6b56bcdef19fd154bc71bc5665
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: d8108df1af11397a5f9eb0cb94d23b6045a7de0830802216e32b8eab0121211e
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: d8108df1af11397a5f9eb0cb94d23b6045a7de0830802216e32b8eab0121211e
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0298958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 029895A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 029895D5
GetModuleFileNameA.KERNEL32(00000000), ref: 029895DC
wsprintfA.USER32 ref: 02989635
wsprintfA.USER32 ref: 02989673
wsprintfA.USER32 ref: 029896F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02989758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0298978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 029897D8

Strings

PromptOnSecureDesktop, xrefs: 02989604, 02989624, 02989662, 02989683, 029896B6, 029896DF, 02989701, 02989734, 02989780, 029897B7

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 55f417ee055c5726427645665b82fdcfb159d62d5a64b4ad7319d012e50198f3
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: B5A18EB290024CAFEB21EFA1CC45FEA3BADEB44741F144026FA15E6251E7B5D584CFA4

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

06A, xrefs: 0040BF70
86A, xrefs: 0040BF98
46A, xrefs: 0040BF85
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5de4b720525195bfa21f7211d5f61df3d951c59e2526b8a2204b20cbe9ca94a4
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5de4b720525195bfa21f7211d5f61df3d951c59e2526b8a2204b20cbe9ca94a4
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_USER, xrefs: 0040B431
%s@%s, xrefs: 0040B461
%TO_EMAIL, xrefs: 0040B473
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2
%DATE, xrefs: 0040B4D2
%TO_HASH, xrefs: 0040B4B0
%FROM_EMAIL, xrefs: 0040B3E9
%TO_USER, xrefs: 0040B488
%TO_DOMAIN, xrefs: 0040B44B
%FROM_DOMAIN, xrefs: 0040B41E

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 07bf672bddbe06c2f420d96725ac0e1f54ef040b4224a6cef6ca6ba202742de3
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: 07bf672bddbe06c2f420d96725ac0e1f54ef040b4224a6cef6ca6ba202742de3
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 66737db9b915561633ae3f492ee5f4d9e9eb10476a5fdfc482486e88eb260942
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: 66737db9b915561633ae3f492ee5f4d9e9eb10476a5fdfc482486e88eb260942
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: a4c47fe232f0f429a5e45ffdfbe97dd16a9fcdfbaa8a3ef520d6a4c94dc9225a
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: a4c47fe232f0f429a5e45ffdfbe97dd16a9fcdfbaa8a3ef520d6a4c94dc9225a
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 02983059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02983068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02983078
GetProcAddress.KERNEL32(00000000,00410408), ref: 02983095
RtlAllocateHeap.NTDLL(00000000), ref: 029830B6
htons.WS2_32(00000035), ref: 029830EF
inet_addr.WS2_32(?), ref: 029830FA
gethostbyname.WS2_32(?), ref: 0298310D
HeapFree.KERNEL32(00000000), ref: 0298314D

Strings

iphlpapi.dll, xrefs: 02983062, 02983067, 02983077

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 377739c0a55ca553ae163feacfe3064d0a172440425f3881f530d1086cf18c7e
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: D2318431A00606ABDB11AFB8DC48BBE77BCAF05F64F1841A5E518E7290DB74D541CB5C

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: eb7510e18f4f3ad5f9c27a48c5e533d648c270866267e0b44efdedb47f858b72
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: eb7510e18f4f3ad5f9c27a48c5e533d648c270866267e0b44efdedb47f858b72
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 02986778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 029867C3
htonl.WS2_32(?), ref: 029867DF
htonl.WS2_32(?), ref: 029867EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 029868F1
ExitProcess.KERNEL32 ref: 029869BC

Strings

localcfg, xrefs: 02986994
except_info, xrefs: 0298698F

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: d251992e419296f6b7d4e786a17e704c1e912ed9bcb6dc3f31abddd5cb15c9a3
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 0E616F71A40208AFDB60AFB4DC45FEA77E9FB48300F14806AFA6DD6161EB7599908F14

Function 0298F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0298CC84), ref: 0298F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0298F5CE
closesocket.WS2_32(00000000), ref: 0298F5DC

Strings

time_cfg, xrefs: 0298F58A

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 1b3e68439ce615247c8620c8ccd9a1323f7dff1738515dbe765d01c4d430a8aa
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 52316C7290011CABDB10EFA5DC88DEE7BBCEF88314F544566F915E3150E7709A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 02982F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02982FA1
LoadLibraryA.KERNEL32(?), ref: 02982FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02982FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02983000
RtlAllocateHeap.NTDLL(00000000), ref: 02983007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02983032

Strings

dnsapi.dll, xrefs: 02982F90

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 933002573633a8ecf4d76bcd29ba8d85aa9b4b5dd7f46a6d354c5ad01a86f5be
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: F9217F71D01629BBCB22AFA5DC48AEEBBBCEF08B54F044461F905E7540D7B49A81C7E4

Function 02986F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\iwmorlyx,02987043), ref: 02986F4E
GetProcAddress.KERNEL32(00000000), ref: 02986F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02986F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02986F92

Strings

PromptOnSecureDesktop, xrefs: 02986F9D, 02986FBF, 02986FCF, 02986FE5, 02986FF5
\\.\pipe\iwmorlyx, xrefs: 02986F37
C:\Windows\SysWOW64\, xrefs: 02986F30, 02986F38, 02986F65, 02986F6C, 02986F7A, 02986F85, 02986F91, 02986FA9, 02986FC6, 02986FEC

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\iwmorlyx
API String ID: 1082366364-4187546015
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: a07ed5fb6391bea80720a34b0bddc522d58fcf759d2c85c1b880f768a0ec9713
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: D12105617413407EF722B7319C88FFB2E4C8B92724F2C40A5F944EA590DBD9C4D686AD

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: bb3a68048dca612602b0c8d6e49c283fb6b7b0927c26922aed4f6a4c5afedb24
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: bb3a68048dca612602b0c8d6e49c283fb6b7b0927c26922aed4f6a4c5afedb24
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 029892CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 029892E2
wsprintfA.USER32 ref: 02989350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02989375
lstrlen.KERNEL32(?,?,00000000), ref: 02989389
WriteFile.KERNEL32(00000000,?,00000000), ref: 02989394
CloseHandle.KERNEL32(00000000), ref: 0298939B

Strings

PromptOnSecureDesktop, xrefs: 0298932B, 02989343, 0298935E

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: a9fb2f660235b968e9414087b592e6ed8836d74a3c5fff0080ddcd193463ff1c
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: B01172B27401147BE7207B32EC0DFEF3A6EDBC8B11F048065BB09E5190EBB54A458B64

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 029899E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02989A18
GetThreadContext.KERNEL32(?,?), ref: 02989A52
TerminateProcess.KERNEL32(?,00000000), ref: 02989A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02989A98
SetThreadContext.KERNEL32(?,00010002), ref: 02989AB5
ResumeThread.KERNEL32(?), ref: 02989AC2

Strings

D, xrefs: 02989A10

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: fbab47a9dd51416c581fb5914389ea0d029135e792af7146e28567566185b578
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: F7213BB1A01219BBEB11ABA1DC09EEF7BBCEF04754F444061FA19E6150E7758A44CBA4

Function 02981C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02981C18
LoadLibraryA.KERNEL32(004102C8), ref: 02981C26
GetProcessHeap.KERNEL32 ref: 02981C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02981C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02981CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 02981D02
FreeLibrary.KERNEL32(?), ref: 02981D0B

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 4690098fae2128c083e2548faeca8738ea4ac6fcc42249b5b9b741292450495a
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 54313C32E00219BFCB11AFA4DC889AEBBB9EF45715B28447AE509E3110D7B54E81DB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: ef12e745c0d8ac77b0bd51427e5f83480508b91c038ebc09813fba6640af01bf
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: ef12e745c0d8ac77b0bd51427e5f83480508b91c038ebc09813fba6640af01bf
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 02986CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02986CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02986D22
GetLastError.KERNEL32 ref: 02986DA7
CloseHandle.KERNEL32(?), ref: 02986DB5
GetLastError.KERNEL32 ref: 02986DD6
DeleteFileA.KERNEL32(?), ref: 02986DE7
GetLastError.KERNEL32 ref: 02986DFD

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 4081abbfc7ae9b094a6e1ba3592b5839950e2433f263192f51b4a5a6d7d4d856
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 66310172900249BFCB01EFA4DD48ADE7F7DEF88300F188475E251EB211E7708A958B61

Function 029893AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 029893C6
GetModuleFileNameA.KERNEL32(00000000), ref: 029893CD
CharToOemA.USER32(?,?), ref: 029893DB
wsprintfA.USER32 ref: 02989410

Part of subcall function 029892CB: GetTempPathA.KERNEL32(00000400,?), ref: 029892E2
Part of subcall function 029892CB: wsprintfA.USER32 ref: 02989350
Part of subcall function 029892CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02989375
Part of subcall function 029892CB: lstrlen.KERNEL32(?,?,00000000), ref: 02989389
Part of subcall function 029892CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 02989394
Part of subcall function 029892CB: CloseHandle.KERNEL32(00000000), ref: 0298939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02989448

Strings

PromptOnSecureDesktop, xrefs: 029893FA, 029893FF, 0298941C

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 30256395cc4018e1a5e94d1b7216ecbc76a5f9bac2b7a236f44142a376d1eedc
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 59015EF69001587BEB21A7619D89EEF3B7CDBD5701F0040A2BB49E2080EAB497C58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 0298AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0298AAE5

Strings

localcfg, xrefs: 0298AD72
, xrefs: 0298ABB3

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction ID: c3dd1e685f380747dbddc4be5bb4143ff85c5fdf3f65bd2e692e24b6b0271813
Opcode Fuzzy Hash: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction Fuzzy Hash: C8712A72A00304AADF21BB54DC85FEE376DAF41709F2C446BFA04E6090EF7699C48B59

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0298E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0298DF6C: GetCurrentThreadId.KERNEL32 ref: 0298DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0298E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02986128), ref: 0298E950
lstrcmp.KERNEL32(?,00000008), ref: 0298E989

Strings

A, xrefs: 0298E960, 0298E965
A, xrefs: 0298E8C6, 0298E8CD, 0298E936, 0298E998
A, xrefs: 0298E9A0

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 602936a52ecc37996a72043426164afcfa8994e2ebdde353cb4ba50675fa6209
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 9C319031A007059BDB71AF24C894BA67BE8EF05724F08892AF5D5C7551D3B2E880CB91

Function 02986E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02986E19

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 666c8dd7a7291e541be23ff28c7bcf271789c912571b0c2d20a6891a73ab1c1f
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: EF215C73204219BFDB10BBB4FC49EDF3FAEEB49264B188425F502D5092EB70DA509A74

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 0298C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0298C6B4
InterlockedIncrement.KERNEL32(0298C74B), ref: 0298C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0298C747), ref: 0298C728
CloseHandle.KERNEL32(00000000,?,0298C747,00413588,02988A77), ref: 0298C733

Strings

localcfg, xrefs: 0298C544

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 6137840431f5fe29868402446c5222a8067f2b009abe4df8c3b97f22cb7c08df
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 7F515EB1A01B458FD728AF69C5D462ABBE9FB48304B54593FE18BC7A90D774F444CB20

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: 50e144e5c66517dd62c9eb504a4f9f7b4843c8d6198543f26dab993f1630d953
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 50e144e5c66517dd62c9eb504a4f9f7b4843c8d6198543f26dab993f1630d953
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0298E2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0298E50A,00000000,00000000,00000000,00020106,00000000,0298E50A,00000000,000000E4), ref: 0298E319
RegSetValueExA.ADVAPI32(0298E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0298E38E
RegDeleteValueA.ADVAPI32(0298E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0298E3BF
RegCloseKey.ADVAPI32(0298E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0298E50A), ref: 0298E3C8

Strings

PromptOnSecureDesktop, xrefs: 0298E33A

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 831010f01960275a4296de05932f9400509810f622c21afe8e5c52a166353136
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: CB212C71A0021DBBDF21AFA5EC89EDE7F79EF48750F048062F944A6160E7718A54DBA0

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 029871C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 029871E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02987228
LocalFree.KERNEL32(?,?,?), ref: 02987286
wsprintfA.USER32 ref: 0298729D

Strings

|, xrefs: 0298721A

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 30fd56244da92d7477631100744421950475031b2c882bba81e05cda1fa0f0b7
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: F4312B76900208BFDB01EFA8DC45BDA7BACEF04314F18C066F959DB200EB75D6488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0298B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0298B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0298B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0298B548
GetTimeZoneInformation.KERNEL32(?), ref: 0298B590
wsprintfA.USER32 ref: 0298B61E

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 6b967df997b06531cbb26f0912bdddea5224d35eb5cc7def1ffada00b1c52c5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 57513FB1D0021DAACF14DFD5D8889EEBBB9BF48304F14812AF501A6150E7B84AC9CF98

Function 029862D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 02986303
LoadLibraryA.KERNEL32(?), ref: 0298632A
GetProcAddress.KERNEL32(00000000,?), ref: 029863B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 02986405

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 5d0d2f520b2352d3ee6786897b6cf1206ad6162d9dff67c5e2e000c1656221a6
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: FE416D71A00209EFDB14EF68D884BADB7BCFF04358F18856AE955DB290D771E940CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 53a70ba93e4b2c34d413b9add9e26c4f8e9f0de61643a904c0250f6f0d42246e
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: 53a70ba93e4b2c34d413b9add9e26c4f8e9f0de61643a904c0250f6f0d42246e
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0298E795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0298DF6C: GetCurrentThreadId.KERNEL32 ref: 0298DFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0298A6AC), ref: 0298E7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0298A6AC), ref: 0298E7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0298A6AC), ref: 0298E819

Strings

PromptOnSecureDesktop, xrefs: 0298E840, 0298E845, 0298E87C, 0298E89B

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: dc169cdafc9007b6bc2bd82d6cfebe9b51cef00d38e0bf85dec23b64b7363165
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 8221C7F1A403007AF2217B319C45FEB3E5DDFA5B60F180039FA4AB51D3FAA595508AB5

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: e52c754b5c4df7ac7535869be25ad2b94008d4c8a4726cb9c757c49838e9d70c
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: e52c754b5c4df7ac7535869be25ad2b94008d4c8a4726cb9c757c49838e9d70c
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 5c3f6046797f5d804895e4c05c4277987be728c98b5bed37973dbb72bca93dd1
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 5c3f6046797f5d804895e4c05c4277987be728c98b5bed37973dbb72bca93dd1
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 02987665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 029876D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0298796D
RegCloseKey.ADVAPI32(?), ref: 0298797E

Strings

PromptOnSecureDesktop, xrefs: 029876C5, 029876CA, 029876E5

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 90ef466cc792bacb917c8980499745a20db82460a974c0cf8bcabfedc65369f5
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: BF11AC70A00109AFDB12AFA9DC44FEFBF7DEB95714F280561F515E6290E7B18940CB61

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 02989966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0298999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 029899BD
RegCloseKey.ADVAPI32(?), ref: 029899C6

Strings

PromptOnSecureDesktop, xrefs: 02989989, 0298998E, 029899B0, 029899D3

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 0b474e3b731493ff6d0211421c1be1b362850d63ea232d876f8eafdb44395fda
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 1DF0F6B2A80208BFF7107B51EC06FDB3A2CDB94B14F100060FA05B5081F6E59A9086B9

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: c32bd2a19c33d57a97dc38e480cb8eff028dd4ac8e1228206779d83c5918f3cf
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: c32bd2a19c33d57a97dc38e480cb8eff028dd4ac8e1228206779d83c5918f3cf
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 029828EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 029828FA
gethostbyname.WS2_32(u6A), ref: 02982906

Strings

time_cfg, xrefs: 029828EB
u6A, xrefs: 029828EC, 029828F9, 02982905

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 6d6c85396817faf5279e98517b6cbf3d5b95e5756b007168bdcaa7e661529523
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9DE01231A045519FDB50AB2CF848AD577E9EF4A230F098595F854D71A0C774DCC19754

Function 029869C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 029869E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 02986A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 02986A3A
CloseHandle.KERNEL32(000000FF), ref: 02986BD8

Part of subcall function 0298EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02981DCF,?), ref: 0298EEA8
Part of subcall function 0298EE95: HeapFree.KERNEL32(00000000), ref: 0298EEAF

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: a17846267c3fcae400d56cba566f9543919355a09b47e8689b02cba19f610fba
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: AC71277190421DEFDF11EFA4CC81AEEBBBDFB04318F14456AE515AA190D7349E92CB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 029841F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0298421F
GetLastError.KERNEL32 ref: 02984229
WaitForSingleObject.KERNEL32(?,?), ref: 0298423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0298424D

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: d488b5e4a4a0c9b787e3b2486ceefc605ce48d5e86c23a2907767e016b870a9f
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: F801C87251510AAFDF01EF90ED84BEF7BACEF08255F148461F901E6050D770DA548BB6

Function 0298417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 029841AB
GetLastError.KERNEL32 ref: 029841B5
WaitForSingleObject.KERNEL32(?,?), ref: 029841C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 029841D9

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: a8e847494f6e068b9ae451129513e879f237be2cac5ecc06d76817beda6e861b
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 0601087691110AAFDF01EF90ED84BEF7BACEF28259F008061F901E2050D770DA648BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 0298E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0298E066

Strings

A, xrefs: 0298E036
A, xrefs: 0298E037, 0298E03C
A, xrefs: 0298E07F

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 2cc220b576a0dbd45beede438fc29146cb999d17f71132ecb5e5eba1d861611b
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 16F0CD322083069BCB20DF64DC84A82B7ECFB09325B088A2AF599C3060D370E498CB55

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0298E3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,029844E2,00000000,00000000,00000000), ref: 0298E470
CloseHandle.KERNEL32(00000001,00000003), ref: 0298E484

Part of subcall function 0298E2FC: RegCreateKeyExA.ADVAPI32(80000001,0298E50A,00000000,00000000,00000000,00020106,00000000,0298E50A,00000000,000000E4), ref: 0298E319
Part of subcall function 0298E2FC: RegSetValueExA.ADVAPI32(0298E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0298E38E
Part of subcall function 0298E2FC: RegDeleteValueA.ADVAPI32(0298E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0298E3BF
Part of subcall function 0298E2FC: RegCloseKey.ADVAPI32(0298E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0298E50A), ref: 0298E3C8

Strings

PromptOnSecureDesktop, xrefs: 0298E4F1, 0298E4F6, 0298E537, 0298E561

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 415fc2d9bad8dc38706f9583b40a52304aac1d0de099cc57e96ab0d85419343d
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: FB41D5B2D00218BAEF207F618C45FEB3B6CEB44764F188025FE4EA4191E7B59650DAB5

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: a7932ee6e11f51e31df66d5708ae860d6aff00331a4d04ea59eecfc3ddd3bc48
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: a7932ee6e11f51e31df66d5708ae860d6aff00331a4d04ea59eecfc3ddd3bc48
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 02988330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 029883C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02988477

Part of subcall function 029869C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 029869E5
Part of subcall function 029869C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 02986A26
Part of subcall function 029869C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 02986A3A

Part of subcall function 0298EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02981DCF,?), ref: 0298EEA8
Part of subcall function 0298EE95: HeapFree.KERNEL32(00000000), ref: 0298EEAF

Strings

PromptOnSecureDesktop, xrefs: 029883B2, 029883B7, 02988483

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 9ad9c4e5fd1df64fabe3491f165c29dab78c1fd3038fbcc9a8842bdd95eb98c2
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 64417EB290010DBFEB10FBA09D80EFF776DEB44344F5844AAE509E6050EBB05A948B60

Function 0298E631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0298E859,00000000,00020119,0298E859,PromptOnSecureDesktop), ref: 0298E64D
RegCloseKey.ADVAPI32(0298E859,?,?,?,?,000000C8,000000E4), ref: 0298E787

Strings

PromptOnSecureDesktop, xrefs: 0298E637

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 52d6793068220e61bcb8b066505d1ea5bc2fcaf32ee8a01acb57c9ccc48a9ecd
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: F441F8B2D0011DBFDF11AFA4DC84DEEBBBDFB48304F184466FA10A6150E3719A559B60

Function 0298AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0298AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0298B00D

Part of subcall function 0298AF6F: gethostname.WS2_32(?,00000080), ref: 0298AF83
Part of subcall function 0298AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0298AFE6

Part of subcall function 0298331C: gethostname.WS2_32(?,00000080), ref: 0298333F
Part of subcall function 0298331C: gethostbyname.WS2_32(?), ref: 02983349

Part of subcall function 0298AA0A: inet_ntoa.WS2_32(00000000), ref: 0298AA10

Strings

%OUTLOOK_BND_, xrefs: 0298B076, 0298B07B, 0298B0BE, 0298B0DD

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction ID: da01b893042e1031a44655ea6c604b154c3a4e08879c56aafc1669c5b96c94d8
Opcode Fuzzy Hash: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction Fuzzy Hash: 58410E7290024CABDB25EFA0DC45EEE3BADFB48304F184426F929D2151EA75E6548F54

Function 02989452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02989536
Sleep.KERNEL32(000001F4), ref: 0298955D

Strings

, xrefs: 029894D9

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 7cde711daba6109626910151c189af90f2e9825d99c8ad6b6ce9fc6eb37aa8c5
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 294107B19083956EFB36BB74D89C7B63BEC9B02314F1C01A5D886973A2D7B44981C711

Function 0298BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0298B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0298BA3A
InterlockedIncrement.KERNEL32(?), ref: 0298BA94
GetTickCount.KERNEL32 ref: 0298BB79
GetTickCount.KERNEL32 ref: 0298BB99
InterlockedIncrement.KERNEL32(?), ref: 0298BE15
closesocket.WS2_32(00000000), ref: 0298BEB4

Strings

%FROM_EMAIL, xrefs: 0298BC7D

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: fb298d3d7822d6fe8175d5a54dd73412313f17ecb979cc6c13e6e7fe08268ca5
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 4E317E72400248DFDF25EFA4DC54BEDB7A9EB44704F284456FA15C2161EB34D685CF54

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 07e354698f15fd9fc768e13d315d3543d6c442699b8c7836c4f7c54cdd5a5fd6
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: 07e354698f15fd9fc768e13d315d3543d6c442699b8c7836c4f7c54cdd5a5fd6
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 0298709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 029870BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 029870F4

Strings

|, xrefs: 029870E6

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 533515cdf3fb7bc1127afcb9317b4cc67b00d9f3984e2ac4898c20a600adfca1
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 69112A76900118EBDB51DBD4DC84AEEB7BCAB04309F2841A6E511E7094D7709B88CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 02983189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02982F88: GetModuleHandleA.KERNEL32(?), ref: 02982FA1
Part of subcall function 02982F88: LoadLibraryA.KERNEL32(?), ref: 02982FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 029831DA
HeapFree.KERNEL32(00000000), ref: 029831E1

Memory Dump Source

Source File: 00000000.00000002.4192342662.0000000002980000.00000040.00001000.00020000.00000000.sdmp, Offset: 02980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2980000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 904df2328fb53c775301df53d284e81ab38bfe16915510542e3d85f913275646
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 15517B7190024AEFCF01AF64D888AFAB779FF05705F1845A9EC96C7210E732DA19CB94

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.4190916179.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4190916179.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AvDJi40xp_9fyz7RPmKdbxb4.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 44b2ceadd519ca45f912a616d592807794313ca1f1de80b4bcf7ee55ccb8d493
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 44b2ceadd519ca45f912a616d592807794313ca1f1de80b4bcf7ee55ccb8d493
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: lfkidgdf.exePID: 2696, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	0%
Total number of Nodes:	1538
Total number of Limit Nodes:	13

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
\, xrefs: 00409D0C
D, xrefs: 00409F8E
", xrefs: 0040A189
", xrefs: 00409EDB
%X%08X, xrefs: 0040A0B0
C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 0040A1D9
", xrefs: 0040A078
qeuwztgf, xrefs: 0040A389, 0040A397
P, xrefs: 00409DAA

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\AvDJi40xp_9fyz7RPmKdbxb4.exe$C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe$D$P$\$qeuwztgf
API String ID: 2089075347-2445309917
Opcode ID: 51b3fdeb16769e607b7420a4e79e81e5addf88b96e881b4fbfa3e3990a533921
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 51b3fdeb16769e607b7420a4e79e81e5addf88b96e881b4fbfa3e3990a533921
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: ee9ff6285cd0759b386b71dc2009f55f092fb3ff13d227db5bcc73c144141d81
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: ee9ff6285cd0759b386b71dc2009f55f092fb3ff13d227db5bcc73c144141d81
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: fb32ede88c892ccab39cf83d003fcbea33a4e2e8563a4575a47fd59e5a1c2ade
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: fb32ede88c892ccab39cf83d003fcbea33a4e2e8563a4575a47fd59e5a1c2ade
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 02A7003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02A7024D

Strings

kernel32.dll, xrefs: 02A7008F, 02A70095
cess, xrefs: 02A7018D

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 32d3fd7280cd05cad9257b11b7c02c66dc2b2caaf79ce192a75636483f59f898
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: F5526975A01229DFDB64CF68C985BACBBB1BF09304F1480D9E94DAB351DB30AA85DF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 4febc6132cbb2eeae90f99f22907b6d3a51082cd0e0b87a57774915eab482f02
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 4febc6132cbb2eeae90f99f22907b6d3a51082cd0e0b87a57774915eab482f02
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 02A70E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02A70223,?,?), ref: 02A70E19
SetErrorMode.KERNELBASE(00000000,?,?,02A70223,?,?), ref: 02A70E1E

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: c224823c744e8b4c61bd3faedf22d19e0189772e116107a51520a2286331485b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: FCD0123114512877D7002B94DC09BCD7B1CDF09B66F008011FB0DD9080CB70954046E9

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 02AB1844 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02AB188C

Memory Dump Source

Source File: 0000000B.00000002.2160657446.0000000002AAD000.00000040.00000020.00020000.00000000.sdmp, Offset: 02AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2aad000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 06af0f0b55c9ccdd9452eaa6d0492f039699fc6962140b3b47a7ece2ec782a1b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: FBF062321007116FDB213BF5A8DCBEA76ECFF49665F100528E64A910C1DF70E9458A61

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 02AB1503 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02AB1554

Memory Dump Source

Source File: 0000000B.00000002.2160657446.0000000002AAD000.00000040.00000020.00020000.00000000.sdmp, Offset: 02AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2aad000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 531eaac7c4d96c922100ac7a87a69ad8a7fac2f1bfbbb8e0346867d1278acd66
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 35112B79A40208EFDB01DF98CA95E98BFF5AF08750F1580A4F9489B362D771EA50DF90

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 02A765E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 02A765F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02A76610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02A76631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02A76652

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 91d8e4455adb412d360fcbefd51214dd56fcd78b1d35ba433a00ab05af252b99
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 8F114F71600218BFDB259F65DD45F9B3FACEB05BA5F104024FA09A7251DBB1DD008AA8

Function 02A79EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02A79E6D
lstrcpy.KERNEL32(?,00000000), ref: 02A79FE1
lstrcat.KERNEL32(?,?), ref: 02A79FF2
lstrcat.KERNEL32(?,0041070C), ref: 02A7A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 02A7A054
DeleteFileA.KERNEL32(?), ref: 02A7A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02A7A0D6
lstrcpy.KERNEL32 ref: 02A7A12F
lstrlen.KERNEL32(00000022), ref: 02A7A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 02A79F13

Part of subcall function 02A77029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02A77081

Part of subcall function 02A76F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\iwmorlyx,02A77043), ref: 02A76F4E
Part of subcall function 02A76F30: GetProcAddress.KERNEL32(00000000), ref: 02A76F55
Part of subcall function 02A76F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02A76F7B
Part of subcall function 02A76F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02A76F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 02A7A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 02A7A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 02A7A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 02A7A21B
GetDriveTypeA.KERNEL32(?), ref: 02A7A265
lstrcat.KERNEL32(?,00000000), ref: 02A7A29F
lstrcat.KERNEL32(?,00410A34), ref: 02A7A2C5
lstrcat.KERNEL32(?,00000022), ref: 02A7A2D9
lstrcat.KERNEL32(?,00410A34), ref: 02A7A2F4
wsprintfA.USER32 ref: 02A7A31D
lstrcat.KERNEL32(?,00000000), ref: 02A7A345
lstrcat.KERNEL32(?,?), ref: 02A7A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 02A7A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 02A7A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 02A7A1D1

Part of subcall function 02A79966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 02A7999D
Part of subcall function 02A79966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 02A799BD
Part of subcall function 02A79966: RegCloseKey.ADVAPI32(?), ref: 02A799C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 02A7A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 02A7A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 02A7A41D

Strings

", xrefs: 02A7A3F0
P, xrefs: 02A7A011
\, xrefs: 02A79F73
", xrefs: 02A7A142
D, xrefs: 02A7A1F5
", xrefs: 02A7A2DF

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 34a7a4f8073281681ce54dad7b3482ef90154d9983337e3af99793530f55e198
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 88F132B1D40259BFDF11DFA08D88FEF7BBDAB08304F0444A6E605E2141EB758A858F69

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtSetInformationToken, xrefs: 00401175
RtlSetLastWin32Error, xrefs: 004010D6
NtClose, xrefs: 004011B4
RtlLengthSid, xrefs: 00401246
NtOpenProcessToken, xrefs: 004011D4
NtTerminateProcess, xrefs: 004010F6
NtSetInformationThread, xrefs: 00401155
RtlInitUnicodeString, xrefs: 00401135
RtlFreeSid, xrefs: 00401116
RtlAllocateAndInitializeSid, xrefs: 0040120F
ntdll.dll, xrefs: 0040100D
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtDuplicateToken, xrefs: 004011F3
RtlNtStatusToDosError, xrefs: 00401194
NtQueryInformationToken, xrefs: 00401262
NtFilterToken, xrefs: 0040122B

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: def56848a29238af3b3263ec016d123599b8ce3514d2c8bce6aae186bf62253e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: def56848a29238af3b3263ec016d123599b8ce3514d2c8bce6aae186bf62253e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Jun, xrefs: 0040B279
Jan, xrefs: 0040B256
Thu, xrefs: 0040B241
Dec, xrefs: 0040B2A3
Sep, xrefs: 0040B28E
Feb, xrefs: 0040B25D
Apr, xrefs: 0040B26B
Jul, xrefs: 0040B280
Sun, xrefs: 0040B225
Mar, xrefs: 0040B264
Sat, xrefs: 0040B24F
Mon, xrefs: 0040B22C
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Nov, xrefs: 0040B29C
May, xrefs: 0040B272
Oct, xrefs: 0040B295
Wed, xrefs: 0040B23A
Aug, xrefs: 0040B287
Tue, xrefs: 0040B233
Fri, xrefs: 0040B248

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 9c254f7c2f4551e4858b08560ebcfb375181b6b247abdacfd65a4178375c92cf
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: 9c254f7c2f4551e4858b08560ebcfb375181b6b247abdacfd65a4178375c92cf
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24
D, xrefs: 00407B0C

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe$D
API String ID: 2976863881-2152778875
Opcode ID: eb1a08a2c71bfc4e71cb34ece599553e47f8ddafd4bc37f5bbc1e22e926e6740
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: eb1a08a2c71bfc4e71cb34ece599553e47f8ddafd4bc37f5bbc1e22e926e6740
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 02A77CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02A77D21
GetUserNameA.ADVAPI32(?,?), ref: 02A77D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02A77D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02A77DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02A77DC0
EqualSid.ADVAPI32(?,?), ref: 02A77DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 02A77DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02A77DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02A77E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02A77E12
LocalFree.KERNEL32(00000000), ref: 02A77E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02A77E35

Strings

C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 02A77F49, 02A77F76, 02A77F8A, 02A77F8B
D, xrefs: 02A77D73

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe$D
API String ID: 2976863881-2152778875
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 81012a10efef0bd9fbd97f21a6845b65fe5ac994851f800d8eed89598f63cb57
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 28A13072900219AFDF11DFA5DD88FEFBBB9FB08304F04816AE505E6150DB758A85CB68

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

12:08:32, xrefs: 00406535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
plgs:, xrefs: 004066AA
localcfg, xrefs: 0040672D
va=%08X%08X uef=%p, xrefs: 00406595
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
%d=%p, xrefs: 004066F9
except_info, xrefs: 00406728
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
Jan 13 2018, xrefs: 0040653A

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 61f8b68dd9f344f506cfc8e29852887e470a3443c6047e34725b67e0d060e89d
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: 61f8b68dd9f344f506cfc8e29852887e470a3443c6047e34725b67e0d060e89d
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

., xrefs: 0040A8CA
localcfg, xrefs: 0040AB0B
Incorrect respons, xrefs: 0040AB39
helo %s, xrefs: 0040A803
ehlo %s, xrefs: 0040A7F5
Too small respons, xrefs: 0040A9C9
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
AUTH LOGIN, xrefs: 0040A80C
Too big smtp respons (%d bytes), xrefs: 0040A9B1
mail from:<%s>, xrefs: 0040A848
rcpt to:<%s>, xrefs: 0040A855
quit, xrefs: 0040A86C
data, xrefs: 0040A85E
ESMTP, xrefs: 0040AA38

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ae3e940a4bde8c590484db18a6dae5c4a8b1995a6f5a2f6c6eb5761f3b661a67
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ae3e940a4bde8c590484db18a6dae5c4a8b1995a6f5a2f6c6eb5761f3b661a67
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 93d2068cc19732fe8ad9ae0a9f51e86421eb0c8fa32be1230cd8688bd4bd79d5
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: 93d2068cc19732fe8ad9ae0a9f51e86421eb0c8fa32be1230cd8688bd4bd79d5
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 02A77A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02A77A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02A77ACD
GetLengthSid.ADVAPI32(?), ref: 02A77ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02A77B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02A77B1F
EqualSid.ADVAPI32(?,?), ref: 02A77B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 02A77B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02A77B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02A77B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02A77B77
LocalFree.KERNEL32(00000000), ref: 02A77B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02A77B9A
GetAce.ADVAPI32(?,?,?), ref: 02A77BCA
EqualSid.ADVAPI32(?,?), ref: 02A77BF1
DeleteAce.ADVAPI32(?,?), ref: 02A77C0A
EqualSid.ADVAPI32(?,?), ref: 02A77C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 02A77CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02A77CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02A77CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02A77CE0
LocalFree.KERNEL32(00000000), ref: 02A77CEE

Strings

D, xrefs: 02A77AC3

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 261f536df26bc27f7138e5e4e1e6509b459b6fd9bbf8c767ab94f968aeaf6828
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 5F813E72900219AFDB11CFA5DD84FEEBBB8AF0C304F14816AE605E6150DB759A45CFA8

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe$localcfg
API String ID: 237177642-1714200430
Opcode ID: 15b9b55687a82b41d6800692092713c8c708d1165b0f2aaaab3cbeed006d9429
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 15b9b55687a82b41d6800692092713c8c708d1165b0f2aaaab3cbeed006d9429
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

, xrefs: 00401462
%systemroot%\system32\cmd.exe, xrefs: 00401316
PDu, xrefs: 0040139A
<, xrefs: 00401378
useless, xrefs: 0040161E
wusa.exe, xrefs: 00401388
D, xrefs: 004015C6
@, xrefs: 00401380
uac, xrefs: 00401628

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 4a22ad167bc3991e7243980079933dba70382744969d1905516b1f864c22465e
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 4a22ad167bc3991e7243980079933dba70382744969d1905516b1f864c22465e
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
loader_id, xrefs: 00401F4B, 00401F6B
net_type, xrefs: 00401E87
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
born_date, xrefs: 00401EAD, 00401ECC
kernel32, xrefs: 00401DF7
work_srv, xrefs: 00401E5E
start_srv, xrefs: 00401E6C
lid_file_upd, xrefs: 00401E25
IsWow64Process, xrefs: 00401DF2

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: c2d043fcc5cbb47ed0bea78f2b79b5e209498882ff798d96aae41c0d31e4dbc2
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: c2d043fcc5cbb47ed0bea78f2b79b5e209498882ff798d96aae41c0d31e4dbc2
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 02A7858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 02A7865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 02A7867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 02A786A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02A786B1

Strings

C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 02A7882F, 02A7883C, 02A7884C
", xrefs: 02A7896C

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe
API String ID: 237177642-595768964
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 78f432e62eb4a801af843fe09e1ccd1a216145993f94ce288b6fa2f66fdbfe6b
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: CCC1A272940108BEEB11EBA4DE88EEF7BBDEB04304F144066F605E2050EF744A94AF69

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 02A714E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02A71601
lstrlenW.KERNEL32(-00000003), ref: 02A717D8

Strings

D, xrefs: 02A7182D
@, xrefs: 02A715E7
<, xrefs: 02A715DF
, xrefs: 02A716C9

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 6f934caf2e61c6602e4c79946ebd85e1a8ab8ee5a01971e03227b52035a6b027
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 77F17BB15083419FD720CF64CC88BABB7F5FB88305F00892DF69A97290DBB49945CB5A

Function 02A77666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 02A776D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02A77757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 02A7778F
___ascii_stricmp.LIBCMT ref: 02A778B4
RegCloseKey.ADVAPI32(?), ref: 02A7794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 02A7796D
RegCloseKey.ADVAPI32(?), ref: 02A7797E
RegCloseKey.ADVAPI32(?), ref: 02A779AC
RegCloseKey.ADVAPI32(?), ref: 02A77A56

Part of subcall function 02A7F40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,02A7772A,?), ref: 02A7F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02A779F6
RegCloseKey.ADVAPI32(?), ref: 02A77A4D

Strings

", xrefs: 02A77800

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 2acba5b7e67d858c66da3d2177b47453645b7b943fb4788889b6dd017f738969
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 5BC18372940209AFEB11DBA4DD84FEEBBB9EF49710F1440A5E504E6190EF719A84CB68

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 618cfb6f1b26c540220dcc2678a44076c62346fd56d5638b59146fa8fa35b1d5
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 618cfb6f1b26c540220dcc2678a44076c62346fd56d5638b59146fa8fa35b1d5
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 00409326 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 02A72CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02A72CED
socket.WS2_32(00000002,00000002,00000011), ref: 02A72D07
htons.WS2_32(00000000), ref: 02A72D42
select.WS2_32 ref: 02A72D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 02A72DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02A72E62

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 5b5248153aaf16d2b248ac865c9e913e3098dc003a4634e28e49e13ed2f0a7a1
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: AD61B071504305AFC7209F64DC48BABBBF8EB88755F04481AFD8597251DBB5D880CBAA

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
127.0.0.1, xrefs: 0040ADEB
%s%d, xrefs: 0040AE58
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_HST, xrefs: 0040AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 5cd659d1eb2281404cf1ff7fe35be06c0bda1c6b56bcdef19fd154bc71bc5665
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: 5cd659d1eb2281404cf1ff7fe35be06c0bda1c6b56bcdef19fd154bc71bc5665
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: d8108df1af11397a5f9eb0cb94d23b6045a7de0830802216e32b8eab0121211e
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: d8108df1af11397a5f9eb0cb94d23b6045a7de0830802216e32b8eab0121211e
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: e164254f3378dd396073a59d5f8bf438da5901e9f91fe2d8a4805c76184d12e6
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: e164254f3378dd396073a59d5f8bf438da5901e9f91fe2d8a4805c76184d12e6
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s@%s, xrefs: 0040B461
%DATE, xrefs: 0040B4D2
%TO_EMAIL, xrefs: 0040B473
%FROM_EMAIL, xrefs: 0040B3E9
%TO_DOMAIN, xrefs: 0040B44B
%FROM_DOMAIN, xrefs: 0040B41E
%TO_HASH, xrefs: 0040B4B0
%FROM_USER, xrefs: 0040B431
%M5DATE, xrefs: 0040B50F
%TO_USER, xrefs: 0040B488
%P5DATE, xrefs: 0040B4F2

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 07bf672bddbe06c2f420d96725ac0e1f54ef040b4224a6cef6ca6ba202742de3
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: 07bf672bddbe06c2f420d96725ac0e1f54ef040b4224a6cef6ca6ba202742de3
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 66737db9b915561633ae3f492ee5f4d9e9eb10476a5fdfc482486e88eb260942
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: 66737db9b915561633ae3f492ee5f4d9e9eb10476a5fdfc482486e88eb260942
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: a4c47fe232f0f429a5e45ffdfbe97dd16a9fcdfbaa8a3ef520d6a4c94dc9225a
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: a4c47fe232f0f429a5e45ffdfbe97dd16a9fcdfbaa8a3ef520d6a4c94dc9225a
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 02A73059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02A73068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02A73078
GetProcAddress.KERNEL32(00000000,00410408), ref: 02A73095
RtlAllocateHeap.NTDLL(00000000), ref: 02A730B6
htons.WS2_32(00000035), ref: 02A730EF
inet_addr.WS2_32(?), ref: 02A730FA
gethostbyname.WS2_32(?), ref: 02A7310D
HeapFree.KERNEL32(00000000), ref: 02A7314D

Strings

iphlpapi.dll, xrefs: 02A73062, 02A73067, 02A73077

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 8058fdc25c8d5a2da641762846a0e067de04acd0053e034b33782a086dd7873b
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 4631E831A01206BBDF119BB89C88BAE77B8EF04364F1581A5F918E3290DF74D545DB5C

Function 02A7958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 02A795A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 02A795D5
GetModuleFileNameA.KERNEL32(00000000), ref: 02A795DC
wsprintfA.USER32 ref: 02A79635
wsprintfA.USER32 ref: 02A79673
wsprintfA.USER32 ref: 02A796F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02A79758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02A7978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02A797D8

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: afbdef89e3950f32a56ced8988efa639823a6500036a76d877311f28c2d13aff
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: DCA169B2940209EFEB21DFA4CD85FDB3BADAB08741F104026FA1596151EBB59584CFA8

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: eb7510e18f4f3ad5f9c27a48c5e533d648c270866267e0b44efdedb47f858b72
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: eb7510e18f4f3ad5f9c27a48c5e533d648c270866267e0b44efdedb47f858b72
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5de4b720525195bfa21f7211d5f61df3d951c59e2526b8a2204b20cbe9ca94a4
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5de4b720525195bfa21f7211d5f61df3d951c59e2526b8a2204b20cbe9ca94a4
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 02A76778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 02A767C3
htonl.WS2_32(?), ref: 02A767DF
htonl.WS2_32(?), ref: 02A767EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02A768F1
ExitProcess.KERNEL32 ref: 02A769BC

Strings

localcfg, xrefs: 02A76994
except_info, xrefs: 02A7698F

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 83654054af3eadbcfebb27a0fb273379080675c0e8a5732220335c41f3a38e10
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: BF615E71A40208AFDB609FB4DC45FEA77E9FB08300F248066FA6DD2161EB759994CF54

Function 02A7F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(02A7CC84), ref: 02A7F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 02A7F5CE
closesocket.WS2_32(00000000), ref: 02A7F5DC

Strings

time_cfg, xrefs: 02A7F58A

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 5b63afe2042f16a458bb42a280393b4aac55030b719da6a01dd4abd224bee87d
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: F8315A72900118AFDB10DFA9DC88DEE7BBCEF88310F104566F915E3150EB709B818BA8

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 02A72F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02A72FA1
LoadLibraryA.KERNEL32(?), ref: 02A72FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02A72FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02A73000
RtlAllocateHeap.NTDLL(00000000), ref: 02A73007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02A73032

Strings

dnsapi.dll, xrefs: 02A72F90

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 6ea5670b3f23f04f52511b9ce17f4ef9b4a7dd89a943d2d47d739ca60a4f4e48
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 1B217471D41629BBCB219B65DC88EEEBBBCEF08B50F014461F905E7140DBB49AC297D8

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 02A799E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02A79A18
GetThreadContext.KERNEL32(?,?), ref: 02A79A52
TerminateProcess.KERNEL32(?,00000000), ref: 02A79A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02A79A98
SetThreadContext.KERNEL32(?,00010002), ref: 02A79AB5
ResumeThread.KERNEL32(?), ref: 02A79AC2

Strings

D, xrefs: 02A79A10

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 7ef955fd1d28c9eda122d1bee262a80ff111091786eb37f120a064fa5f09837d
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: BA216BB1A02219BBDB11DBA1DC48EEF7BBCEF04750F004061BA19E1050EB718A41CBA8

Function 02A71C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02A71C18
LoadLibraryA.KERNEL32(004102C8), ref: 02A71C26
GetProcessHeap.KERNEL32 ref: 02A71C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02A71C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02A71CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 02A71D02
FreeLibrary.KERNEL32(?), ref: 02A71D0B

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: f22d46dbc04786ab2667790ee946d156548f1d93b8a0d316bcf86f6ffdc2b448
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: DC314B32E00219BFCB119FE4DCC89FEBBF9EB45715B24447AE509A2110DBB54E80DB98

Function 02A76CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02A76CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02A76D22
GetLastError.KERNEL32 ref: 02A76DA7
CloseHandle.KERNEL32(?), ref: 02A76DB5
GetLastError.KERNEL32 ref: 02A76DD6
DeleteFileA.KERNEL32(?), ref: 02A76DE7
GetLastError.KERNEL32 ref: 02A76DFD

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: e29f088b684f740503433a04994f7587764372db3e235188a2e9e98843f59ee2
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 2A310372900A49BFCB01DFE4DE88BDE7F7DEB48700F148066E211E3211DB708A458B69

Function 02A76F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\iwmorlyx,02A77043), ref: 02A76F4E
GetProcAddress.KERNEL32(00000000), ref: 02A76F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02A76F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02A76F92

Strings

\\.\pipe\iwmorlyx, xrefs: 02A76F37
C:\Windows\SysWOW64\, xrefs: 02A76F30, 02A76F38, 02A76F65, 02A76F6C, 02A76F7A, 02A76F85, 02A76F91, 02A76FA9, 02A76FC6, 02A76FEC

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\iwmorlyx
API String ID: 1082366364-3234941893
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: a0a862a7f284562746581e662311edc0f7e52f681fc333cf1e33f337b1924141
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: D02105217813407EF72253359DC8FFB6E5C8B52B24F1840A6F944E6590DFD988D6C2AD

Function 02A7AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 02A7AAE5

Strings

, xrefs: 02A7ABB3
localcfg, xrefs: 02A7AD72

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction ID: 0ca874634632cc7f09a6f93c0023b8d605b5dfa92c07b27ea6fd6d566d757326
Opcode Fuzzy Hash: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction Fuzzy Hash: 91712B72A40304BAEF319B94DDC5FEE376EAB40709F244066FA05A6093DF6299C48B5D

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 02A7E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02A7DF6C: GetCurrentThreadId.KERNEL32 ref: 02A7DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 02A7E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02A76128), ref: 02A7E950
lstrcmp.KERNEL32(?,00000008), ref: 02A7E989

Strings

A, xrefs: 02A7E8C6, 02A7E8CD, 02A7E936, 02A7E998
A, xrefs: 02A7E9A0
A, xrefs: 02A7E960, 02A7E965

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 4b05bca5c643e04b5546c83c0668a213b056f3271ca4f32e733dc9a3890df126
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: B731AF32A04706DBDF71CF24CEC4BA6BBE8EF05725F1089AAE55587550DB70E880CB99

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: bb3a68048dca612602b0c8d6e49c283fb6b7b0927c26922aed4f6a4c5afedb24
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: bb3a68048dca612602b0c8d6e49c283fb6b7b0927c26922aed4f6a4c5afedb24
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 02A76E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02A76E19

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 00a0f1c20717ffad520c2c584d39bc78a2f859fb70f77ccc51ce710bb12ad715
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: AB214A72204619BFDB119BA0ED88FDF3FADEB49A65B108465F502D1090EF70DA409A78

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 02A792CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 02A792E2
wsprintfA.USER32 ref: 02A79350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02A79375
lstrlen.KERNEL32(?,?,00000000), ref: 02A79389
WriteFile.KERNEL32(00000000,?,00000000), ref: 02A79394
CloseHandle.KERNEL32(00000000), ref: 02A7939B

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: d10890bbd57a405e915ab87a2c0f7c03097c7ddcb14235e9876b2ca77a28a221
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 9F1157B57401147FE7206B75DE0DFEF3A6EDBC5B11F008066BB05E5090EEB44E558A68

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 02A7C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02A7C6B4
InterlockedIncrement.KERNEL32(02A7C74B), ref: 02A7C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,02A7C747), ref: 02A7C728
CloseHandle.KERNEL32(00000000,?,02A7C747,00413588,02A78A77), ref: 02A7C733

Strings

localcfg, xrefs: 02A7C544

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 530d8b5f215d2719d553cebe26c9c3d58c0839234496d46124527bd9ba0443b3
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 825141B1601B419FD7248F29C9D461ABBFAFB48314B50693FE18BC7A90DB74E440CB14

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe
API String ID: 124786226-2080065891
Opcode ID: af514698247d92645eaa8a26d12ecf441a4c22af2d789d8c6bf78666e30c58a7
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: af514698247d92645eaa8a26d12ecf441a4c22af2d789d8c6bf78666e30c58a7
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 02A771C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02A771E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02A77228
LocalFree.KERNEL32(?,?,?), ref: 02A77286
wsprintfA.USER32 ref: 02A7729D

Strings

|, xrefs: 02A7721A

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 43c842c3fef238a8641dc46b38e446e4e5a9446cb7e06684b206932aa7391687
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 9D311A72A00208BFDB01DFA8DD45BDABBACEF04314F148066F959DB210EB75D7488B98

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 02A7B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02A7B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 02A7B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 02A7B548
GetTimeZoneInformation.KERNEL32(?), ref: 02A7B590
wsprintfA.USER32 ref: 02A7B61E

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 6ef86061a0427df9abf8efc48d4561fabfd86e7a10edb773a0c3c6c21088c51d
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 7A510FB1D0021DAACF14DFD5DD885EEBBB9BF48304F10856AF505A6150E7B84AC9CFA8

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: ef12e745c0d8ac77b0bd51427e5f83480508b91c038ebc09813fba6640af01bf
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: ef12e745c0d8ac77b0bd51427e5f83480508b91c038ebc09813fba6640af01bf
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 5dd434fdf3d1b2f7ac71eae5deaa1b81d7ffa9032da077e8e99a06cc7be058a2
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: 5dd434fdf3d1b2f7ac71eae5deaa1b81d7ffa9032da077e8e99a06cc7be058a2
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 02A762D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 02A76303
LoadLibraryA.KERNEL32(?), ref: 02A7632A
GetProcAddress.KERNEL32(00000000,?), ref: 02A763B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 02A76405

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: a034f138229bcd0c6332b2c2320b283ce8a8c94b515f493a71a914df8407d638
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 02415C71A00A09EFDB14CF58CD84BA9B7B9FF04B58F1881B9E825D7290EB71E940CB54

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 02A793AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 02A793C6
GetModuleFileNameA.KERNEL32(00000000), ref: 02A793CD
CharToOemA.USER32(?,?), ref: 02A793DB
wsprintfA.USER32 ref: 02A79410

Part of subcall function 02A792CB: GetTempPathA.KERNEL32(00000400,?), ref: 02A792E2
Part of subcall function 02A792CB: wsprintfA.USER32 ref: 02A79350
Part of subcall function 02A792CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02A79375
Part of subcall function 02A792CB: lstrlen.KERNEL32(?,?,00000000), ref: 02A79389
Part of subcall function 02A792CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 02A79394
Part of subcall function 02A792CB: CloseHandle.KERNEL32(00000000), ref: 02A7939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02A79448

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 304592a56e23f16e4db978f300cbb7d6dfd134228a95e60e8e8540202d0f7dc2
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 280152F69401187BD721A7619D89EDF777CDB95701F0040A2BB49E2080EAB497C58F79

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 53a70ba93e4b2c34d413b9add9e26c4f8e9f0de61643a904c0250f6f0d42246e
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: 53a70ba93e4b2c34d413b9add9e26c4f8e9f0de61643a904c0250f6f0d42246e
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 5c3f6046797f5d804895e4c05c4277987be728c98b5bed37973dbb72bca93dd1
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 5c3f6046797f5d804895e4c05c4277987be728c98b5bed37973dbb72bca93dd1
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 02A728EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 02A728FA
gethostbyname.WS2_32(u6A), ref: 02A72906

Strings

u6A, xrefs: 02A728EC, 02A728F9, 02A72905
time_cfg, xrefs: 02A728EB

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 920de0406b014ff37440a384606aad7448a28413dbd8f2f9a50be4f5791c31c7
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: F5E0EC306045119FDB509B28FC88BD577A5AF4A230F058595F854D71A0CB74DD819658

Function 02A769C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 02A769E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 02A76A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 02A76A3A
CloseHandle.KERNEL32(000000FF), ref: 02A76BD8

Part of subcall function 02A7EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02A71DCF,?), ref: 02A7EEA8
Part of subcall function 02A7EE95: HeapFree.KERNEL32(00000000), ref: 02A7EEAF

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: e62b52f15aecfc16f0abec82da81adb1a942f74b05cb6e562d5700a022cc5e90
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 0C71377194061DEFDF10DFA4CC80AEEBBBDFB44714F1045AAE615AA190DB309E92CB64

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 02A7E2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02A7E50A,00000000,00000000,00000000,00020106,00000000,02A7E50A,00000000,000000E4), ref: 02A7E319
RegSetValueExA.ADVAPI32(02A7E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 02A7E38E
RegDeleteValueA.ADVAPI32(02A7E50A,?,?,?,?,?,000000C8,004122F8), ref: 02A7E3BF
RegCloseKey.ADVAPI32(02A7E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,02A7E50A), ref: 02A7E3C8

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: ddd93ec987cc9cff366bb49aebf579883763ce02ad2332d04003f72b7e9ca761
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 50214971A00219ABDB209FA4ED89EEE7F79EF08750F0080A1F904E6150EB718A54DBA4

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 02A741F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02A7421F
GetLastError.KERNEL32 ref: 02A74229
WaitForSingleObject.KERNEL32(?,?), ref: 02A7423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02A7424D

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: b6f0f42f00c10b8d36facdb175ec6cd2a877bfeff8d431749e1ed60c663e77f3
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 7F01C872515109AFEF01DF90ED84BEFBBBCEB18255F108461F901E2450DB70DA648BBA

Function 02A7417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02A741AB
GetLastError.KERNEL32 ref: 02A741B5
WaitForSingleObject.KERNEL32(?,?), ref: 02A741C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02A741D9

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 386d04da049268269c34ce5267f2a6eea74304cc9a54bb83fed643e98580cdf2
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 73010C7651111AAFDF01EF90ED84BEF7B7CEB18256F004061F901E2050DB70DA548BB9

Function 02A7E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 02A7E066

Strings

A, xrefs: 02A7E037, 02A7E03C
A, xrefs: 02A7E07F
A, xrefs: 02A7E036

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 5bf74b8bdaffc55e7f214871a18d9292a121dc7bc5a384f56ec96abf4661e8b8
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: DAF062312007029BCF20CF25DDC4A82B7E9FB05325B4486AAE554C3460D774A49ACB59

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 02A78330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 02A783C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02A78477

Part of subcall function 02A769C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 02A769E5
Part of subcall function 02A769C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 02A76A26
Part of subcall function 02A769C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 02A76A3A

Part of subcall function 02A7EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02A71DCF,?), ref: 02A7EEA8
Part of subcall function 02A7EE95: HeapFree.KERNEL32(00000000), ref: 02A7EEAF

Strings

C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 02A7848C, 02A784A1

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe
API String ID: 359188348-2080065891
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 439d53469b9b135a58eee405a489c1e38c8d579b0bc0d1d0fa805a06782dde63
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: EB4160B2940108BEEB20EBA49EC4EFF777DEB04314F1444B6E504D6010FFB45A949B69

Function 02A7AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02A7AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 02A7B00D

Part of subcall function 02A7AF6F: gethostname.WS2_32(?,00000080), ref: 02A7AF83
Part of subcall function 02A7AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 02A7AFE6

Part of subcall function 02A7331C: gethostname.WS2_32(?,00000080), ref: 02A7333F
Part of subcall function 02A7331C: gethostbyname.WS2_32(?), ref: 02A73349

Part of subcall function 02A7AA0A: inet_ntoa.WS2_32(00000000), ref: 02A7AA10

Strings

%OUTLOOK_BND_, xrefs: 02A7B076, 02A7B07B, 02A7B0BE, 02A7B0DD

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction ID: 5712033c5f6eb3ed96a9e976cdffb49438e0374824a2c962bc898376f618384f
Opcode Fuzzy Hash: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction Fuzzy Hash: 0B4130B294020CAFDB25EFA0DD45EEE3BADFF08304F144426FA24D2151EA75DA558F68

Function 02A79452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02A79536
Sleep.KERNEL32(000001F4), ref: 02A7955D

Strings

, xrefs: 02A794D9

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 9053f10cb8d9cf1926ee91da214ffba54c30ec6a489dd33ad3924a196cf4af69
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: FC4107B18043A66EFB368B68DCDC7E73BA59B02314F1841E7D482971A2DF744989C719

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: addf51b803be8b3fdc0b349711ac0ded489e61cd96ba8191abdedb398079e53a
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: addf51b803be8b3fdc0b349711ac0ded489e61cd96ba8191abdedb398079e53a
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 02A7BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02A7B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 02A7BA3A
InterlockedIncrement.KERNEL32(?), ref: 02A7BA94
GetTickCount.KERNEL32 ref: 02A7BB79
GetTickCount.KERNEL32 ref: 02A7BB99
InterlockedIncrement.KERNEL32(?), ref: 02A7BE15
closesocket.WS2_32(00000000), ref: 02A7BEB4

Strings

%FROM_EMAIL, xrefs: 02A7BC7D

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 4e4a4019ed2020db1a7d4239e47260d69e23219ab91fb2aa269004b11a79faa0
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 2D316AB1500248EFDF25DFA4DC84AEEB7B9EB48705F204856FA2482261DF30D685CF28

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 07e354698f15fd9fc768e13d315d3543d6c442699b8c7836c4f7c54cdd5a5fd6
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: 07e354698f15fd9fc768e13d315d3543d6c442699b8c7836c4f7c54cdd5a5fd6
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 02A7709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 02A770BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 02A770F4

Strings

|, xrefs: 02A770E6

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 3095ceb37734f8372eacf53e00dc213b270158d235e272c03c31361a8ec683b6
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 8A112172A0011CEBDF11CFD5DC84ADEF7BDAB04715F1441A6E501E61A4DB709B88CBA8

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000B.00000002.2158741061.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 44b2ceadd519ca45f912a616d592807794313ca1f1de80b4bcf7ee55ccb8d493
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 44b2ceadd519ca45f912a616d592807794313ca1f1de80b4bcf7ee55ccb8d493
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 02A73189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02A72F88: GetModuleHandleA.KERNEL32(?), ref: 02A72FA1
Part of subcall function 02A72F88: LoadLibraryA.KERNEL32(?), ref: 02A72FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02A731DA
HeapFree.KERNEL32(00000000), ref: 02A731E1

Memory Dump Source

Source File: 0000000B.00000002.2160610575.0000000002A70000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_lfkidgdf.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 5aa124aa051e5b4eac7b11f922cb6aeb56fb7c3e8d2143c167a73d950d246b49
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 67519C7190024AAFCF019F64DC88AFAB775FF25305F1541A9EC96C7210EB32DA19CB98

Analysis Process: svchost.exePID: 4048, Parent PID: 2696COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 02B0C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02B0CA4E
closesocket.WS2_32(?), ref: 02B0CB63
GetTempPathA.KERNEL32(00000120,?), ref: 02B0CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B0CCB4
WriteFile.KERNEL32(02B0A4B3,?,-000000E8,?,00000000), ref: 02B0CCDC
CloseHandle.KERNEL32(02B0A4B3), ref: 02B0CCED
wsprintfA.USER32 ref: 02B0CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02B0CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 02B0CD89
CloseHandle.KERNEL32(?), ref: 02B0CD98
CloseHandle.KERNEL32(?), ref: 02B0CD9D
DeleteFileA.KERNEL32(?), ref: 02B0CDC4
CloseHandle.KERNEL32(02B0A4B3), ref: 02B0CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02B0CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02B0CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02B0D033
lstrcatA.KERNEL32(?,04100108), ref: 02B0D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 02B0D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 02B0D171
WriteFile.KERNEL32(00000000,0410012C,?,?,00000000), ref: 02B0D195
CloseHandle.KERNEL32(00000000), ref: 02B0D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 02B0D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02B0D231
lstrcatA.KERNEL32(?,04100108,?,?,?,?,?,?,?,00000100), ref: 02B0D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02B0D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02B0D2C7
WriteFile.KERNEL32(00000000,0410012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02B0D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02B0D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02B0D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02B0D372
lstrcatA.KERNEL32(?,04100108,?,?,?,?,?,?,?,00000100), ref: 02B0D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02B0D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02B0D408
WriteFile.KERNEL32(00000000,0410012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02B0D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02B0D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02B0D45B
CreateProcessA.KERNEL32(?,02B10264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02B0D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02B0D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02B0D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02B0D513
closesocket.WS2_32(?), ref: 02B0D56C
Sleep.KERNEL32(000003E8), ref: 02B0D577
ExitProcess.KERNEL32 ref: 02B0D583
wsprintfA.USER32 ref: 02B0D81F

Part of subcall function 02B0C65C: send.WS2_32(00000000,?,00000000), ref: 02B0C74B

closesocket.WS2_32(?), ref: 02B0DAD5

Strings

flags_upd, xrefs: 02B0CE4A
C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 02B0CC10, 02B0CCF3, 02B0D975, 02B0D98E
.sys, xrefs: 02B0D0CC
except_info, xrefs: 02B0D8CD, 02B0D8D2, 02B0D8FB
wtm_r, xrefs: 02B0C97F
wtm_w, xrefs: 02B0C96C
\, xrefs: 02B0D3A7
lid_file_upd, xrefs: 02B0CE6A
wtm_c, xrefs: 02B0C956
.dat, xrefs: 02B0D0D7, 02B0D138, 02B0D1AE, 02B0D1D4, 02B0D28E, 02B0D308, 02B0D3CF, 02B0D441
local_time, xrefs: 02B0CACD
localcfg, xrefs: 02B0CA89, 02B0CA93, 02B0CAC0, 02B0CAD2, 02B0CE4F, 02B0CE6F, 02B0D8D3, 02B0D8FC
\, xrefs: 02B0D39D
time_cfg, xrefs: 02B0C95B, 02B0C962, 02B0C971, 02B0C984
srv_time, xrefs: 02B0CABB
drivers\, xrefs: 02B0D067
work_srv, xrefs: 02B0D607, 02B0D60F, 02B0D62C
@, xrefs: 02B0D754
4, xrefs: 02B0D9F7

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-36586020
Opcode ID: aac17a41ad031ba562929fa70c1f9035604520c26b934564517fc6bfa401046d
Instruction ID: e17b2a2e367ad8e7b80e7f145489cc3e306df7fda6a5e43180174f98b6689f86
Opcode Fuzzy Hash: aac17a41ad031ba562929fa70c1f9035604520c26b934564517fc6bfa401046d
Instruction Fuzzy Hash: 10B2A571D40209AFEB12ABA4DCC5FAE7FA9EB08344F5409EAF905A71D0E7309995CF50

Function 02B09A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02B09A7F
SetErrorMode.KERNELBASE(00000003), ref: 02B09A83
SetUnhandledExceptionFilter.KERNEL32(02B06511), ref: 02B09A8A

Part of subcall function 02B0EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 02B0EC5E
Part of subcall function 02B0EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02B0EC72
Part of subcall function 02B0EC54: GetTickCount.KERNEL32 ref: 02B0EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02B09AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02B09ABA
GetCommandLineA.KERNEL32 ref: 02B09AFD
lstrlenA.KERNEL32(?), ref: 02B09B99
ExitProcess.KERNEL32 ref: 02B09C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02B09CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02B09D7A
lstrcatA.KERNEL32(?,?), ref: 02B09D8B
lstrcatA.KERNEL32(?,02B1070C), ref: 02B09D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02B09DED
DeleteFileA.KERNEL32(00000022), ref: 02B09E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02B09E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02B09EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02B09ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02B09F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02B09F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02B09F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02B09FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02B09FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02B09FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 02B0A038
lstrcatA.KERNEL32(00000022,02B10A34), ref: 02B0A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 02B0A072
lstrcatA.KERNEL32(00000022,02B10A34), ref: 02B0A08D
wsprintfA.USER32 ref: 02B0A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 02B0A0DE
lstrcatA.KERNEL32(00000022,?), ref: 02B0A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 02B0A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02B0A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 02B0A174
GetModuleFileNameA.KERNEL32(00000000), ref: 02B0A17B
GetDriveTypeA.KERNEL32(00000022), ref: 02B0A1B6
GetCommandLineA.KERNEL32 ref: 02B0A1E5

Part of subcall function 02B099D2: lstrcpyA.KERNEL32(?,?,00000100,02B122F8,00000000,?,02B09E9D,?,00000022,?,?,?,?,?,?,?), ref: 02B099DF
Part of subcall function 02B099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02B09E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02B09A3C
Part of subcall function 02B099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02B09E9D,?,00000022,?,?,?), ref: 02B09A52

lstrlenA.KERNEL32(?), ref: 02B0A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 02B0A3B7
GetLastError.KERNEL32 ref: 02B0A3ED
Sleep.KERNELBASE(000003E8), ref: 02B0A400
DeleteFileA.KERNELBASE(02B133D8), ref: 02B0A407
CreateThread.KERNELBASE(00000000,00000000,02B0405E,00000000,00000000,00000000), ref: 02B0A42C
WSAStartup.WS2_32(00001010,?), ref: 02B0A43A
CreateThread.KERNELBASE(00000000,00000000,02B0877E,00000000,00000000,00000000), ref: 02B0A469
Sleep.KERNELBASE(00000BB8), ref: 02B0A48A
GetTickCount.KERNEL32 ref: 02B0A49F
GetTickCount.KERNEL32 ref: 02B0A4B7
Sleep.KERNELBASE(00001A90), ref: 02B0A4C3

Strings

D, xrefs: 02B09F8E
", xrefs: 02B0A078
C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 02B0A1D9
\, xrefs: 02B09D0C
%X%08X, xrefs: 02B0A0B0
qeuwztgf, xrefs: 02B0A389, 02B0A397
P, xrefs: 02B09DAA
", xrefs: 02B0A189
", xrefs: 02B09EDB

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe$D$P$\$qeuwztgf
API String ID: 2089075347-557685099
Opcode ID: 07dc0d646e09009617337cb95964938ade04258c44f5717d0408d78c714f7947
Instruction ID: 95456ab8e3a6ab30f582f6008e35e19ac7c45702c9859487476521533cbd4a65
Opcode Fuzzy Hash: 07dc0d646e09009617337cb95964938ade04258c44f5717d0408d78c714f7947
Instruction Fuzzy Hash: A15273B1D4025DAFDB22ABA08CC9EEE7FBDEB04704F4449E5F605A3181E7749A948F50

Function 02B0199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 02B019B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02B01E9E), ref: 02B019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02B019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 02B019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 02B019F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02B01E9E), ref: 02B01A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02B01E9E), ref: 02B01A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02B01E9E), ref: 02B01A36
GetAdaptersInfo.IPHLPAPI(00000000,02B01E9E,?,?,?,?,00000001,02B01E9E), ref: 02B01A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02B01E9E,?,?,?,?,00000001,02B01E9E), ref: 02B01A5A
GetAdaptersInfo.IPHLPAPI(00000000,02B01E9E,?,?,?,?,00000001,02B01E9E), ref: 02B01A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02B01E9E), ref: 02B01A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02B01E9E), ref: 02B01AA4

Strings

GetAdaptersInfo, xrefs: 02B019DC
GetIfEntry, xrefs: 02B019E4
123.45.67.89, xrefs: 02B019A6
GetBestInterface, xrefs: 02B019EF
Iphlpapi.dll, xrefs: 02B019B7
localcfg, xrefs: 02B019A3

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 5a5ba79d159b0dd6332fba68370033fde115108305b1404c6034f207b61e80d4
Instruction ID: 0ada2215dd3c4e51eab268b6f98116ad204131cf21464c33cc57d6d4d37384da
Opcode Fuzzy Hash: 5a5ba79d159b0dd6332fba68370033fde115108305b1404c6034f207b61e80d4
Instruction Fuzzy Hash: C6319031D10209AFDF16AFE9CCC88BEBFB5EB44751B5449A9F925A3150D7304A90CBA0

Function 02B07A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02B07ABA
GetUserNameA.ADVAPI32(?,?), ref: 02B07ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,02B1070C,?,?,?), ref: 02B07B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02B07B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02B07B59
EqualSid.ADVAPI32(?,00000022), ref: 02B07B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B07B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B07B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02B07B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02B07BAB
LocalFree.KERNEL32(00000000), ref: 02B07BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02B07FC9,?,00000000), ref: 02B07BCE

Strings

C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 02B07CE2, 02B07D0F, 02B07D23, 02B07D24
D, xrefs: 02B07B0C

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe$D
API String ID: 2976863881-2152778875
Opcode ID: 53c5b3bf17449e7fde141e70fd3357cf756ece703facc934061f94afae57abb0
Instruction ID: e19bacc573683294c329b0345dc5b335fa62b18304ad2694ea967d3e3fb709bf
Opcode Fuzzy Hash: 53c5b3bf17449e7fde141e70fd3357cf756ece703facc934061f94afae57abb0
Instruction Fuzzy Hash: 8AA15DB1D40219AFDB129FA0CC88EEEFFB9FB04344F0445A9E905E2180DB349A95DB60

Function 02B07809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02B0782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02B07866
GetLengthSid.ADVAPI32(?), ref: 02B07878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02B0789A
GetSecurityDescriptorOwner.ADVAPI32(?,02B07F63,?), ref: 02B078B8
EqualSid.ADVAPI32(?,02B07F63), ref: 02B078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02B07901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02B07910
LocalFree.KERNEL32(00000000), ref: 02B07917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02B07933
GetAce.ADVAPI32(?,00000000,?), ref: 02B07963
EqualSid.ADVAPI32(?,02B07F63), ref: 02B0798A
DeleteAce.ADVAPI32(?,00000000), ref: 02B079A3
EqualSid.ADVAPI32(?,02B07F63), ref: 02B079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B07A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B07A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02B07A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02B07A79
LocalFree.KERNEL32(00000000), ref: 02B07A87

Strings

D, xrefs: 02B0785C

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: c3d91a0123648064764c78a0ca7402fddf423967e64b5bcb9ba4c76c918d2a30
Instruction ID: 7fd9206cdf51e09dbf7c7434a9aff2b6708b520462bfe1f4070e7760fe0d8ab8
Opcode Fuzzy Hash: c3d91a0123648064764c78a0ca7402fddf423967e64b5bcb9ba4c76c918d2a30
Instruction Fuzzy Hash: 64813E71D0011EABDB12DFA5CD88FEEFBB8EF08344F1445A9EA15E6180DB349651DB60

Function 02B08328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,02B10750,?,?,00000000,localcfg,00000000), ref: 02B083F3
RegQueryValueExA.KERNELBASE(02B10750,?,00000000,?,02B08893,?,?,?,00000000,00000103,02B10750,?,?,00000000,localcfg,00000000), ref: 02B08414
RegSetValueExA.KERNELBASE(02B10750,?,00000000,00000004,02B08893,00000004,?,?,00000000,00000103,02B10750,?,?,00000000,localcfg,00000000), ref: 02B08441
RegCloseKey.ADVAPI32(02B10750,?,?,00000000,00000103,02B10750,?,?,00000000,localcfg,00000000), ref: 02B0844A

Strings

C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 02B085C8, 02B085D5, 02B085E5
localcfg, xrefs: 02B08348

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe$localcfg
API String ID: 237177642-1714200430
Opcode ID: df7870acc337d8ea15809bc1a3da33be24b0f068e0d1eb7d30a53dc185a43611
Instruction ID: 409fd9215b4de07b1b8de3f9a8f79686097c732f652d6115926aed9d19d8875d
Opcode Fuzzy Hash: df7870acc337d8ea15809bc1a3da33be24b0f068e0d1eb7d30a53dc185a43611
Instruction Fuzzy Hash: E9C180B1D4014CBEEB12ABA49CC5EEE7F7DEB05344F1448E5FA05A6081EB709B948F61

Function 02B01D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02B01DC6
GetSystemInfo.KERNELBASE(?), ref: 02B01DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02B01E03
GetProcAddress.KERNEL32(00000000), ref: 02B01E0A
GetCurrentProcess.KERNEL32(?), ref: 02B01E1B
GetTickCount.KERNEL32 ref: 02B01FC9

Part of subcall function 02B01BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02B01C15

Strings

net_type, xrefs: 02B01E87
hi_id, xrefs: 02B01F16, 02B01F1B, 02B01F33
IsWow64Process, xrefs: 02B01DF2
flags_upd, xrefs: 02B01E3E, 02B01E43, 02B01E7C
born_date, xrefs: 02B01EAD, 02B01ECC
loader_id, xrefs: 02B01F4B, 02B01F6B
kernel32, xrefs: 02B01DF7
lid_file_upd, xrefs: 02B01E25
start_srv, xrefs: 02B01E6C
work_srv, xrefs: 02B01E5E
localcfg, xrefs: 02B01E2A, 02B01E31, 02B01E44, 02B01E7D, 02B01E8C, 02B01EB2, 02B01ED1, 02B01EE7, 02B01EFF, 02B01F1C, 02B01F34, 02B01F50, 02B01F70

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: d74baafebed72fd052c646c168139c02b4366ea811bb19e2347ce3c9c1736884
Instruction ID: efe8d28c4d891f94611e8f7fda8a14c8474734c0afa3ca3a005ce9dc99a2e67c
Opcode Fuzzy Hash: d74baafebed72fd052c646c168139c02b4366ea811bb19e2347ce3c9c1736884
Instruction Fuzzy Hash: 8451B3B0904344AFE321AF698CC9F2BBEECEB88748F444D9DF95A82191D774E544CB61

Function 02B073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 02B07472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 02B074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 02B07528
___ascii_stricmp.LIBCMT ref: 02B0764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 02B076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02B07706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 02B07717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 02B07745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 02B077EF

Part of subcall function 02B0F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02B122F8,000000C8,02B07150,?), ref: 02B0F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02B0778F
RegCloseKey.KERNELBASE(?), ref: 02B077E6

Strings

", xrefs: 02B07599

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: b42e0b514aff52459c08f1688622d72636d7c6673879d11f224724a8d00cef7d
Instruction ID: 99d3972f82e7cc42df5c41e0fbe13463a0be44112a2e2ac30aa7a018e3792afa
Opcode Fuzzy Hash: b42e0b514aff52459c08f1688622d72636d7c6673879d11f224724a8d00cef7d
Instruction Fuzzy Hash: E7C17171900209ABEB229BA4DC88FEEFFB9EF45350F1404D5E505A61D0EF71EA94DB60

Function 02B0675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 02B0677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 02B0679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 02B067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 02B067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 02B067D3
ReadFile.KERNELBASE(000000FF,?,00000040,02B08244,00000000,?,74DF0F10,00000000), ref: 02B06807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02B0681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 02B0683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02B0685C
ReadFile.KERNEL32(000000FF,?,00000028,02B08244,00000000,?,74DF0F10,00000000), ref: 02B0688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 02B06906
ReadFile.KERNEL32(000000FF,?,00000000,02B08244,00000000,?,74DF0F10,00000000), ref: 02B0691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 02B06971

Part of subcall function 02B0EC2E: GetProcessHeap.KERNEL32(00000000,02B0EA27,00000000,02B0EA27,00000000), ref: 02B0EC41
Part of subcall function 02B0EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02B0EC48

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 54cda48b7192b5e6e370db205e56c2809a72516145ee2b45b692d02eeedf3485
Instruction ID: b3aac9612ef93ac2bf8b3437be2c2028bc706ae133e523be4979e4a252c53b9b
Opcode Fuzzy Hash: 54cda48b7192b5e6e370db205e56c2809a72516145ee2b45b692d02eeedf3485
Instruction Fuzzy Hash: 3D71E971D0021DEFDB159FA4CC84AEEBBB9FB08354F1045AAF915A6190E7309EA1DB60

Function 02B0F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(02B0CA1D), ref: 02B0F34D
socket.WS2_32(00000002,00000001,00000000), ref: 02B0F367
closesocket.WS2_32(00000000), ref: 02B0F375

Strings

time_cfg, xrefs: 02B0F323

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 85c9498524da1e006d0a6ea08b332a51f41e016b3eef1a482f75d209a9e9125a
Instruction ID: 29c38b8dbfe4d7db1ea67b1afa79f3a5995259d38e3dd7e354e36d606a86a58a
Opcode Fuzzy Hash: 85c9498524da1e006d0a6ea08b332a51f41e016b3eef1a482f75d209a9e9125a
Instruction Fuzzy Hash: E5317E72A40118ABDB21DFA5DC849FE7BBCFF88350F5045A6F915D3180EB749A818BE0

Function 02B0405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02B04070
ExitProcess.KERNEL32 ref: 02B04121

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 66299d956b02df8e1109b4ca682c2d512a57f9e156ed9b3b7cda256d27e46922
Instruction ID: 1e6bdcecec6d69b8b526d8e25ce5dfbadc79050c209215a621e2ce3a267bba74
Opcode Fuzzy Hash: 66299d956b02df8e1109b4ca682c2d512a57f9e156ed9b3b7cda256d27e46922
Instruction Fuzzy Hash: BE516171D40219BADB12ABA08DC9FBF7EBDEB15754F4004A5FB14B60C0E7318A51CB61

Function 02B02D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,02B02F01,?,02B020FF,02B12000), ref: 02B02D3A
LoadLibraryA.KERNEL32(?), ref: 02B02D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02B02D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02B02D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02B02D99
HeapAlloc.KERNEL32(00000000), ref: 02B02DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02B02DCB

Strings

DnsQuery_A, xrefs: 02B02D5B
dnsapi.dll, xrefs: 02B02D29

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: f59dae9bd4900ca8e4a0df9dbdd0d259baf38fb01c8edb4efc75061bb776667f
Instruction ID: 8ac04ec0a8f6f81e984ad092d77b160f67d6bb3f19f0e36179b133f33fbe9cdf
Opcode Fuzzy Hash: f59dae9bd4900ca8e4a0df9dbdd0d259baf38fb01c8edb4efc75061bb776667f
Instruction Fuzzy Hash: D0216271D40229ABCB12AF54DC88AAEBFB9EF08B54F504992FD05E7140D7709ED987D0

Function 02B080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02B0815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,02B0A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02B08187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,02B0A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02B081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02B08210

Part of subcall function 02B0675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 02B0677E
Part of subcall function 02B0675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 02B0679A
Part of subcall function 02B0675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 02B067B0
Part of subcall function 02B0675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 02B067BF
Part of subcall function 02B0675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 02B067D3
Part of subcall function 02B0675C: ReadFile.KERNELBASE(000000FF,?,00000040,02B08244,00000000,?,74DF0F10,00000000), ref: 02B06807
Part of subcall function 02B0675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02B0681F
Part of subcall function 02B0675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 02B0683E
Part of subcall function 02B0675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02B0685C

Part of subcall function 02B0EC2E: GetProcessHeap.KERNEL32(00000000,02B0EA27,00000000,02B0EA27,00000000), ref: 02B0EC41
Part of subcall function 02B0EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02B0EC48

Strings

C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe, xrefs: 02B08225, 02B0823A

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe
API String ID: 124786226-2080065891
Opcode ID: dbae80a34be0f7280ee89f6eac26863e5a9ed23aadbd17d301b50d9dc3cf3ab8
Instruction ID: 7a0603e53abe823d84c4f15b2c50ad3715ec97fc9bacc492d1e100054d577ff8
Opcode Fuzzy Hash: dbae80a34be0f7280ee89f6eac26863e5a9ed23aadbd17d301b50d9dc3cf3ab8
Instruction Fuzzy Hash: C14190B2D45119BFEB12EBA09CC4EBE7F6DDB08344F4408EAE945A7080E7709F948B50

Function 02B01AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02B01AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02B01AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02B01B20

Strings

GetAdaptersAddresses, xrefs: 02B01AE3
Iphlpapi.dll, xrefs: 02B01ACC

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 1f5ff74c9af3d2ab76dfceff76d5c0e5de5a423457d2f2a4799f39b4879f347f
Instruction ID: 10b3105d1670ac8f8f2902d9f312aa415ccba052c5368adcf8ca60078ecdb208
Opcode Fuzzy Hash: 1f5ff74c9af3d2ab76dfceff76d5c0e5de5a423457d2f2a4799f39b4879f347f
Instruction Fuzzy Hash: 0C11D671E11128AFDB1B9BACCCC48ADBFBAEB44B14B5444D5F009E7190E7308A80CB90

Function 02B0E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,02B0E5F2,00000000,00020119,02B0E5F2,02B122F8), ref: 02B0E3E6
RegQueryValueExA.ADVAPI32(02B0E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 02B0E44E
RegQueryValueExA.ADVAPI32(02B0E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 02B0E482
RegQueryValueExA.ADVAPI32(02B0E5F2,?,00000000,?,80000001,?), ref: 02B0E4CF
RegCloseKey.ADVAPI32(02B0E5F2,?,?,?,?,000000C8,000000E4), ref: 02B0E520

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 65aebf6d27ae5f02dc9f9115a49d6e9ef267914a727f7de95a6e225b027b3705
Instruction ID: a24f95d47d8fa70dc4a8d707197d8283141addd94f23bde5b6b44371953b002d
Opcode Fuzzy Hash: 65aebf6d27ae5f02dc9f9115a49d6e9ef267914a727f7de95a6e225b027b3705
Instruction Fuzzy Hash: 1541F8B2D0021DAFDF129FD4DC84DEEBBBAEB08344F5448A6E911A3190E7319A558B60

Function 02B0F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 02B0F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 02B0F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 02B0F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 02B0F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02B0F2FD

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 91e0b61f9382bfe950e8b434cc56f19a0ce14695e6762f132191b71161d70093
Instruction ID: 58b2bd49413f61b988394eaee5840c3e70667928c953b26f12daa0291e526d6d
Opcode Fuzzy Hash: 91e0b61f9382bfe950e8b434cc56f19a0ce14695e6762f132191b71161d70093
Instruction Fuzzy Hash: 0011FBB1A40248BAEB11DE94CD41F9E7FBCEB44751F004066BB04EA1D0E6B19A44CB94

Function 02B01BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B01AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02B01AD4
Part of subcall function 02B01AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02B01AE9
Part of subcall function 02B01AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02B01B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02B01C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02B01C51

Strings

hi_id, xrefs: 02B01BE5
localcfg, xrefs: 02B01BE7

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: dc4c527291702888440b5d33c984a8c8b6b28065273a94a18dd20d89aa073351
Instruction ID: e9a88f52c03a6fb24fa77de2ac32410d659f9ae972c2c9735b5eb9b590accefe
Opcode Fuzzy Hash: dc4c527291702888440b5d33c984a8c8b6b28065273a94a18dd20d89aa073351
Instruction Fuzzy Hash: BA01847291411CBBEB25DAECC8C49EFBABCE744785F1008B6D606E7140D230DE449660

Function 02B01B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02B01AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02B01AD4
Part of subcall function 02B01AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02B01AE9
Part of subcall function 02B01AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02B01B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02B01BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02B01EFD,00000000,00000000,00000000,00000000), ref: 02B01BB8

Strings

localcfg, xrefs: 02B01B7B

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 3c654e67c2948fe1cb097b11b69d898c22a46a5a5f2dd558195ae62ea6000ec0
Instruction ID: 2be4efc9bbe94c8d3edb9f06c480988d7624e10e51fc24d377c589772602815a
Opcode Fuzzy Hash: 3c654e67c2948fe1cb097b11b69d898c22a46a5a5f2dd558195ae62ea6000ec0
Instruction Fuzzy Hash: BC014FB6D0410CBFEB019BE9C8859EFFABDEB48754F1505A2AA15E7180D6705E044AA1

Function 02B02684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000002), ref: 02B02693
gethostbyname.WS2_32(00000002), ref: 02B0269F

Strings

time_cfg, xrefs: 02B02684

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 3afed47cc1c9d48c709bc9d2a65fe96124809f16ca25509b6f033be4fdaff39c
Instruction ID: 4d9b01ef6dc4963457a5e1899a8cdf2a8249b01992bd0552d190eda344d7a4f2
Opcode Fuzzy Hash: 3afed47cc1c9d48c709bc9d2a65fe96124809f16ca25509b6f033be4fdaff39c
Instruction Fuzzy Hash: 94E08C306040119FCB129A68F488A963BA4EF06270F014980FC80C3190CB309CC08680

Function 02B0E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02B0DD05: GetTickCount.KERNEL32 ref: 02B0DD0F
Part of subcall function 02B0DD05: InterlockedExchange.KERNEL32(02B136B4,00000001), ref: 02B0DD44
Part of subcall function 02B0DD05: GetCurrentThreadId.KERNEL32 ref: 02B0DD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,02B0A445), ref: 02B0E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,74DF0F10,?,00000000,?,02B0A445), ref: 02B0E583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,02B0A445), ref: 02B0E5B2

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 84ac1c6fb051c6ff4062a4b39609f4496c82a11386d04b3bffa7f817d4c6f8ef
Instruction ID: ee556160753687027c36b0f2f34cf5ae213a4ef46f0af61fb04488a074dd2827
Opcode Fuzzy Hash: 84ac1c6fb051c6ff4062a4b39609f4496c82a11386d04b3bffa7f817d4c6f8ef
Instruction Fuzzy Hash: C62107B29802043AF6227A655C9AF6F3E4DDB55794F400DD4BE0AB11D3FA51D4108AB1

Function 02B0877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 02B088A5

Part of subcall function 02B0F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02B0E342,00000000,75A8EA50,80000001,00000000,02B0E513,?,00000000,00000000,?,000000E4), ref: 02B0F089
Part of subcall function 02B0F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02B0E342,00000000,75A8EA50,80000001,00000000,02B0E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02B0F093

Strings

localcfg, xrefs: 02B087CA, 02B087CF, 02B087FB, 02B08835, 02B08861
rresolv, xrefs: 02B087F6, 02B0885C

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 4005296fb06b74cca95577523eb3ef3249dfb5802068613729f43480e027bda4
Instruction ID: 7805e992e7366a68faaae8463812cf1280e46ebb16ad5f0bde42a49c0f456d30
Opcode Fuzzy Hash: 4005296fb06b74cca95577523eb3ef3249dfb5802068613729f43480e027bda4
Instruction Fuzzy Hash: AE21F071988300AAF326BB64ACC5F7A3F99EB44750FD408D9FD04860C0FF91A69089A5

Function 02B04000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,02B122F8,02B042B6,00000000,00000001,02B122F8,00000000,?,02B098FD), ref: 02B04021
GetLastError.KERNEL32(?,02B098FD,00000001,00000100,02B122F8,02B0A3C7), ref: 02B0402C
Sleep.KERNEL32(000001F4,?,02B098FD,00000001,00000100,02B122F8,02B0A3C7), ref: 02B04046

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 22ad36968e7bf1399f8051f53348d225fc2de6e0f9a25204adabe3fe91db5825
Instruction ID: dc19701fd48b65ce8188c82ac6f77a489461b0d04733eade86f10d0638a28ac1
Opcode Fuzzy Hash: 22ad36968e7bf1399f8051f53348d225fc2de6e0f9a25204adabe3fe91db5825
Instruction Fuzzy Hash: 63F0A032680205ABD7321A38AC89F6B3AB1EB81738F654FA4F3B6F20D0D73054C19B14

Function 02B0DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02B0DC19,?,00000104), ref: 02B0DB7F
lstrcpyA.KERNEL32(?,02B128F8), ref: 02B0DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 02B0DBC2

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: a0ef7d1c6c26f7ee377a6f5c623e5caca6ba0eab785f33530318c73ca70adada
Instruction ID: b22e02af366f8c60674c06c557a0785ad58d13129d0dda1b4d7e0277ea9be0ee
Opcode Fuzzy Hash: a0ef7d1c6c26f7ee377a6f5c623e5caca6ba0eab785f33530318c73ca70adada
Instruction Fuzzy Hash: C5F09A7054020EABEF21AFA4DC89FE93B69AB10348F6049A4BB91A50D0D7F2D595CB20

Function 02B0EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 02B0EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02B0EC72
GetTickCount.KERNEL32 ref: 02B0EC78

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: c93c3e3fe11df513a7a79e4483f5bc90232ef14fe3699bb5a0de9e39c94f8dc6
Instruction ID: 3ae9cbb010087e4b1da725be984331aaca6211050c088606aeef368f891b24f4
Opcode Fuzzy Hash: c93c3e3fe11df513a7a79e4483f5bc90232ef14fe3699bb5a0de9e39c94f8dc6
Instruction Fuzzy Hash: B0E09AF5C50108BFEB01EBB0EC4EE6B77BCEB08354F900A51B911D6080EA749A548B60

Function 02B030B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02B030D8
gethostbyname.WS2_32(?), ref: 02B030E2

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 9caf14a1da2a8c407d3713715c543c096928dda712543bb918e9fae9d2835010
Instruction ID: 8d173e8f3dc260a8ac5bf3371f7741e4647e4340688e48b546d6a6909116f1db
Opcode Fuzzy Hash: 9caf14a1da2a8c407d3713715c543c096928dda712543bb918e9fae9d2835010
Instruction Fuzzy Hash: 6AE0E571D4111D9BCB10ABA8EC89F9A7BECFB05248F184961F945E7294EA74E5048790

Function 02B0EBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,7FFF0001,80000001,?,02B0DB55,7FFF0001), ref: 02B0EC13
RtlReAllocateHeap.NTDLL(00000000,?,02B0DB55,7FFF0001), ref: 02B0EC1A

Part of subcall function 02B0EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02B0EBFE,7FFF0001,?,02B0DB55,7FFF0001), ref: 02B0EBD3
Part of subcall function 02B0EBCC: RtlAllocateHeap.NTDLL(00000000,?,02B0DB55,7FFF0001), ref: 02B0EBDA

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: a8a2c4adce120dfd9c96eb88e4bc5231a4e3928cb65f4c49a99c26d6da9bb447
Instruction ID: 34f9ccb4a9d48adeacdf96cb8454318948a34e60564ee5fbec0ca3be037671cc
Opcode Fuzzy Hash: a8a2c4adce120dfd9c96eb88e4bc5231a4e3928cb65f4c49a99c26d6da9bb447
Instruction Fuzzy Hash: D2E012325442187ADF023A94E888B997FAADB047A1F548855F90D490A0CB36D5E0DA94

Function 02B0EC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02B0EBA0: GetProcessHeap.KERNEL32(00000000,00000000,02B0EC0A,00000000,80000001,?,02B0DB55,7FFF0001), ref: 02B0EBAD
Part of subcall function 02B0EBA0: HeapSize.KERNEL32(00000000,?,02B0DB55,7FFF0001), ref: 02B0EBB4

GetProcessHeap.KERNEL32(00000000,02B0EA27,00000000,02B0EA27,00000000), ref: 02B0EC41
RtlFreeHeap.NTDLL(00000000), ref: 02B0EC48

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: 245631000ac32246887cfd779c6cdf53de97c236c66bc34ec3e59e9294581b59
Instruction ID: fff9b45db19edb4db4b02b8b420411ad8906716403dddf8509d7e8826e88864e
Opcode Fuzzy Hash: 245631000ac32246887cfd779c6cdf53de97c236c66bc34ec3e59e9294581b59
Instruction Fuzzy Hash: CBC012328462306BC6523650B84CF9B7F68EF45A51F490C89F80567080C76498D046E1

Function 02B0EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,02B0EBFE,7FFF0001,?,02B0DB55,7FFF0001), ref: 02B0EBD3
RtlAllocateHeap.NTDLL(00000000,?,02B0DB55,7FFF0001), ref: 02B0EBDA

Part of subcall function 02B0EB74: GetProcessHeap.KERNEL32(00000000,00000000,02B0EC28,00000000,?,02B0DB55,7FFF0001), ref: 02B0EB81
Part of subcall function 02B0EB74: HeapSize.KERNEL32(00000000,?,02B0DB55,7FFF0001), ref: 02B0EB88

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: d23585728e32c19ca630c081c8ff11f827e96b6233cd6845ca1c4e44ee141144
Instruction ID: b132a69c422c58a5f965ae9887994f8870babdf13e2b72d04184ef2e683dc368
Opcode Fuzzy Hash: d23585728e32c19ca630c081c8ff11f827e96b6233cd6845ca1c4e44ee141144
Instruction Fuzzy Hash: C7C0803254422067C70137A47C0CF9A3EA4DF047D2F044C44F905C3150CB3448E08791

Function 02B0F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,02B0CA44), ref: 02B0F476

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: bd28b8d66762ac0dbc41191661b1a00ec608ec2228d2379c574f3d00d1538ba8
Instruction ID: 51e435ac5fd985a7712e6968570a29d7d4755d14d5a16f789eea86f3c809e80a
Opcode Fuzzy Hash: bd28b8d66762ac0dbc41191661b1a00ec608ec2228d2379c574f3d00d1538ba8
Instruction Fuzzy Hash: DFF01272301559AB9F129E59DCC4CBF3FAEFB892507484561FE14D7110DA31D8618BA0

Function 02B01978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02B01992

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 5ae295eb9f2303e0c4582d247ca5e75fabaed71d05f6ecd4741871fc0144e388
Instruction ID: 1118d55c441f28c16e271e53467dccfd831d7cab7e9475d2e101d28b17b66430
Opcode Fuzzy Hash: 5ae295eb9f2303e0c4582d247ca5e75fabaed71d05f6ecd4741871fc0144e388
Instruction Fuzzy Hash: C9D022226482312A4216371CB80047FAFCCDF052A2740881AFC88C1080CB30C88287D1

Function 02B0DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 02B0DDB5

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: aa82dcade001bb5e25e9d98cbdeb3bc623703048230793fac3e35ac9d44ceea7
Instruction ID: 3c328073352bbaf6a36347395fba11a424096a5734ef91a6ad3ff7d8fdf50405
Opcode Fuzzy Hash: aa82dcade001bb5e25e9d98cbdeb3bc623703048230793fac3e35ac9d44ceea7
Instruction Fuzzy Hash: 1AF08231200213CBCB22CEA498C4656BBE4EF46269F554FBEE555D31C0DB30D855CB11

Non-executed Functions

Function 02B0637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02B09816,EntryPoint), ref: 02B0638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02B09816,EntryPoint), ref: 02B063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02B063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02B063EB

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: fbb16b1233dfecc4da502b25b38ff5f603f06f545abe561dccdd0a54a3c0e188
Instruction ID: d849d399acc419477be52273f917f0f6d4896990d1797a1f362db65a0ac81c73
Opcode Fuzzy Hash: fbb16b1233dfecc4da502b25b38ff5f603f06f545abe561dccdd0a54a3c0e188
Instruction Fuzzy Hash: 9111A771A40219BFDB115F69DC49F9B3FACEB047A4F004464FD04D7280D770DC608AA0

Function 02B01000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02B01839,02B09646), ref: 02B01012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 02B010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 02B010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02B01101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02B01121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02B01140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02B01160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02B01180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 02B0119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 02B011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 02B011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 02B011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 02B0121A

Strings

NtQueryInformationToken, xrefs: 02B01262
RtlLengthSid, xrefs: 02B01246
RtlSetLastWin32Error, xrefs: 02B010D6
RtlFreeSid, xrefs: 02B01116
NtSetInformationToken, xrefs: 02B01175
RtlAllocateAndInitializeSid, xrefs: 02B0120F
NtOpenProcessToken, xrefs: 02B011D4
NtClose, xrefs: 02B011B4
RtlInitUnicodeString, xrefs: 02B01135
ntdll.dll, xrefs: 02B0100D
NtSetInformationThread, xrefs: 02B01155
NtDuplicateToken, xrefs: 02B011F3
NtFilterToken, xrefs: 02B0122B
NtTerminateProcess, xrefs: 02B010F6
RtlExpandEnvironmentStrings_U, xrefs: 02B010BC
RtlNtStatusToDosError, xrefs: 02B01194

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 974d95038bf2cbeec7fa02f257c3eadb9b646d38ef13708d2fa1fb33ea759757
Instruction ID: 34caf3261b0a0b409eba0f09d9c29e03db9be173d0d1ec5c4c25a1affc65b648
Opcode Fuzzy Hash: 974d95038bf2cbeec7fa02f257c3eadb9b646d38ef13708d2fa1fb33ea759757
Instruction Fuzzy Hash: 3351D5719A2601D6E7168A6CACC0B513EE5E3483F4F8447D6AA2AE71E4F7B0C0D1CF61

Function 02B0B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02B0B2B3
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 02B0B2C2
FileTimeToSystemTime.KERNEL32(?,?), ref: 02B0B2D0
SystemTimeToFileTime.KERNEL32(?,?), ref: 02B0B2E1
FileTimeToSystemTime.KERNEL32(?,?), ref: 02B0B31A
GetTimeZoneInformation.KERNEL32(?), ref: 02B0B329
wsprintfA.USER32 ref: 02B0B3B7

Strings

Mon, xrefs: 02B0B22C
May, xrefs: 02B0B272
Nov, xrefs: 02B0B29C
Mar, xrefs: 02B0B264
Thu, xrefs: 02B0B241
Dec, xrefs: 02B0B2A3
Jan, xrefs: 02B0B256
Sep, xrefs: 02B0B28E
Oct, xrefs: 02B0B295
Aug, xrefs: 02B0B287
Sun, xrefs: 02B0B225
Tue, xrefs: 02B0B233
Fri, xrefs: 02B0B248
Apr, xrefs: 02B0B26B
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 02B0B3AF
Jun, xrefs: 02B0B279
Jul, xrefs: 02B0B280
Feb, xrefs: 02B0B25D
Wed, xrefs: 02B0B23A
Sat, xrefs: 02B0B24F

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 8bb851f6d047bc2a42e0b973df2a1e07b3c896908ff6f939755e91d58f34deab
Instruction ID: 4bbad13b045afb2f9382274899310367ca2229e6dcdcf92abe73efd5251a286e
Opcode Fuzzy Hash: 8bb851f6d047bc2a42e0b973df2a1e07b3c896908ff6f939755e91d58f34deab
Instruction Fuzzy Hash: 4E51ECB2E0021DAACF15EFD5D9849EFBBB9EF48304F508899F901A6150D7344AD9CF50

Function 02B06511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B0654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 02B0655C
htonl.WS2_32(?), ref: 02B06578
htonl.WS2_32(?), ref: 02B06587
wsprintfA.USER32 ref: 02B0659B
wsprintfA.USER32 ref: 02B065DC
wsprintfA.USER32 ref: 02B06671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02B0668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02B06696
wsprintfA.USER32 ref: 02B066B0
wsprintfA.USER32 ref: 02B066E7
wsprintfA.USER32 ref: 02B066FF
wsprintfA.USER32 ref: 02B0671F
ExitProcess.KERNEL32 ref: 02B06755

Strings

ver=%d date=%s %sc=%08x a=%p, xrefs: 02B06547
Jan 13 2018, xrefs: 02B0653A
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 02B065D6
plgs:, xrefs: 02B066AA
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 02B0666B
except_info, xrefs: 02B06728
va=%08X%08X uef=%p, xrefs: 02B06595
12:08:32, xrefs: 02B06535
%d=%p, xrefs: 02B066F9
localcfg, xrefs: 02B0672D

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: cd27ce56acf9f814e2c2c005454bcd698a6e9a82ab5c81ada2e0183270260551
Instruction ID: c8b033e93209a7447f4e40c11a9353f865ae0bc01f0793504b9582c82753f92d
Opcode Fuzzy Hash: cd27ce56acf9f814e2c2c005454bcd698a6e9a82ab5c81ada2e0183270260551
Instruction Fuzzy Hash: 39614E72940208EFEB61AFB4DC85FEA7BE9FB08300F1488A9F959D3161DB7195908F50

Function 02B0A7C1 Relevance: 40.5, APIs: 8, Strings: 15, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B0A7FB
lstrlenA.KERNEL32(?), ref: 02B0A87E
send.WS2_32(?,?,00000000,00000000), ref: 02B0A893
wsprintfA.USER32 ref: 02B0A8AF
send.WS2_32(?,.,00000005,00000000), ref: 02B0A8D2
wsprintfA.USER32 ref: 02B0A8E2
recv.WS2_32(?,?,000003F6,00000000), ref: 02B0A97C
wsprintfA.USER32 ref: 02B0A9B9

Strings

ehlo %s, xrefs: 02B0A7F5
Error sending command (sent = %d/%d), xrefs: 02B0A8A7, 02B0A8DA
data, xrefs: 02B0A85E
helo %s, xrefs: 02B0A803
AUTH LOGIN, xrefs: 02B0A80C
Incorrect respons, xrefs: 02B0AB39
rcpt to:<%s>, xrefs: 02B0A855
, xrefs: 02B0A94C
Too small respons, xrefs: 02B0A9C9
localcfg, xrefs: 02B0AB0B
Too big smtp respons (%d bytes), xrefs: 02B0A9B1
quit, xrefs: 02B0A86C
., xrefs: 02B0A8CA
mail from:<%s>, xrefs: 02B0A848
ESMTP, xrefs: 02B0AA38

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$ $AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-4264063882
Opcode ID: c228aa8811e1892a360b019580bf358f802b29876788a5be066c1ef949e7a1d6
Instruction ID: 89c5ecf42e7334075fb4e831d02077e5de7069c48b42276967bccde899c87006
Opcode Fuzzy Hash: c228aa8811e1892a360b019580bf358f802b29876788a5be066c1ef949e7a1d6
Instruction Fuzzy Hash: 0FA10972944305ABEF239A54DCC5FAE3F6AEB00348F144CE6FB06670D0DB61A994CB55

Function 02B01280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02B0139A
lstrlenW.KERNEL32(-00000003), ref: 02B01571

Strings

useless, xrefs: 02B0161E
wusa.exe, xrefs: 02B01388
, xrefs: 02B01462
D, xrefs: 02B015C6
%systemroot%\system32\cmd.exe, xrefs: 02B01316
@, xrefs: 02B01380
PDu, xrefs: 02B0139A
uac, xrefs: 02B01628
<, xrefs: 02B01378

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: ca739b8172906c37da6cf4723baa90f806505b7828ea9ccf73a12d126cc67f41
Instruction ID: 93d93f674382f510328b9cdbfff8205aa93f260ee849fee510a592a15f23c9a9
Opcode Fuzzy Hash: ca739b8172906c37da6cf4723baa90f806505b7828ea9ccf73a12d126cc67f41
Instruction Fuzzy Hash: 70F1BCB15083419FD325DF68C8C8B6ABBE5FB88344F404D9DFA8A9B290D774E944CB52

Function 02B02A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 02B02A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 02B02A86
socket.WS2_32(00000002,00000002,00000011), ref: 02B02AA0
htons.WS2_32(00000000), ref: 02B02ADB
select.WS2_32 ref: 02B02B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02B02B4A
htons.WS2_32(?), ref: 02B02B71
htons.WS2_32(?), ref: 02B02B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02B02BFB

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 382233a3c9be12f33385a2ac237fdcbc20b4bc2029bb64a6c4f384ffe53d1fed
Instruction ID: 51afa2a646bacd89a6c43a0148c3d832aec41c5ac3372d398f059cf93ab83357
Opcode Fuzzy Hash: 382233a3c9be12f33385a2ac237fdcbc20b4bc2029bb64a6c4f384ffe53d1fed
Instruction Fuzzy Hash: A961C4719043059BD722AF65DC8CB6BBFE8FB48785F014C89FD8597180DBB4D8988BA1

Function 02B0704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 02B070C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 02B0719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 02B071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 02B07208
RegCloseKey.ADVAPI32(74DF0F10), ref: 02B07291
___ascii_stricmp.LIBCMT ref: 02B072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 02B072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 02B07314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02B0738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 02B073D8

Part of subcall function 02B0F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02B122F8,000000C8,02B07150,?), ref: 02B0F1AD

Strings

", xrefs: 02B07227
, xrefs: 02B07194

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 7ead798c9b2a8488f822a5e4b8106e89a0c3c1be8cc880db45327f14443cd1ff
Instruction ID: 5ddeb9645020f6aa6d451a655d9643bd92ef1f54896caf8297040191056688dc
Opcode Fuzzy Hash: 7ead798c9b2a8488f822a5e4b8106e89a0c3c1be8cc880db45327f14443cd1ff
Instruction Fuzzy Hash: BCB17471944209AEEB169FA4DC85BDEFBB9EF04304F1009E5F501E60D0EF71AA94DB64

Function 02B0AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02B0AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 02B0ADA6

Part of subcall function 02B0AD08: gethostname.WS2_32(?,00000080), ref: 02B0AD1C
Part of subcall function 02B0AD08: lstrlenA.KERNEL32(?), ref: 02B0AD60
Part of subcall function 02B0AD08: lstrlenA.KERNEL32(?), ref: 02B0AD69
Part of subcall function 02B0AD08: lstrcpyA.KERNEL32(?,LocalHost), ref: 02B0AD7F

Part of subcall function 02B030B5: gethostname.WS2_32(?,00000080), ref: 02B030D8
Part of subcall function 02B030B5: gethostbyname.WS2_32(?), ref: 02B030E2

wsprintfA.USER32 ref: 02B0AEA5

Part of subcall function 02B0A7A3: inet_ntoa.WS2_32(00000000), ref: 02B0A7A9

wsprintfA.USER32 ref: 02B0AE4F
wsprintfA.USER32 ref: 02B0AE5E

Part of subcall function 02B0EF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 02B0EF92
Part of subcall function 02B0EF7C: lstrlenA.KERNEL32(?), ref: 02B0EF99
Part of subcall function 02B0EF7C: lstrlenA.KERNEL32(00000000), ref: 02B0EFA0

Strings

%OUTLOOK_BND_, xrefs: 02B0AE0F, 02B0AE14, 02B0AE57, 02B0AE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 02B0AE9F
%s%d, xrefs: 02B0AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 02B0AE49
%OUTLOOK_HST, xrefs: 02B0AEC5
127.0.0.1, xrefs: 02B0ADEB
%OUTLOOK_MID, xrefs: 02B0AEAE

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 9e8a611c746a637c18af1721fa96b25beb496ca42eabff1711e5248c33c11dbb
Instruction ID: ad1749c1580927948f40ada1bc02bf2c791c5a4b346bb6a379ba99fcbe8ade9b
Opcode Fuzzy Hash: 9e8a611c746a637c18af1721fa96b25beb496ca42eabff1711e5248c33c11dbb
Instruction Fuzzy Hash: FD4101B290030CABEF26EFA0DC85EEF7BADFB08304F144896BA1592191EA75D5548F50

Function 02B02DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,02B02F0F,?,02B020FF,02B12000), ref: 02B02E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02B02F0F,?,02B020FF,02B12000), ref: 02B02E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02B02E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02B02F0F,?,02B020FF,02B12000), ref: 02B02E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02B02F0F,?,02B020FF,02B12000), ref: 02B02E4F
htons.WS2_32(00000035), ref: 02B02E88
inet_addr.WS2_32(?), ref: 02B02E93
gethostbyname.WS2_32(?), ref: 02B02EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02B02F0F,?,02B020FF,02B12000), ref: 02B02EE3
HeapFree.KERNEL32(00000000,?,00000000,02B02F0F,?,02B020FF,02B12000), ref: 02B02EE6

Strings

iphlpapi.dll, xrefs: 02B02DFB, 02B02E00, 02B02E10
GetNetworkParams, xrefs: 02B02E28

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 7dbca931c3207554e42d3c2c91da9f911a88ac447b9bab6275141d3cac673c2e
Instruction ID: 3c4f4d5be30574cced53473aaf831c889e8dfadbf2ce4a7887d450f7871afc0a
Opcode Fuzzy Hash: 7dbca931c3207554e42d3c2c91da9f911a88ac447b9bab6275141d3cac673c2e
Instruction Fuzzy Hash: 8C31C431D8020AABDB12ABB8988CB6F7F78EF04764F140995FD18E72D0DB34D5958B50

Function 02B09326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02B09DD7,?,00000022,?,?,00000000,00000001), ref: 02B09340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02B09DD7,?,00000022,?,?,00000000,00000001), ref: 02B0936E
GetModuleFileNameA.KERNEL32(00000000,?,02B09DD7,?,00000022,?,?,00000000,00000001), ref: 02B09375
wsprintfA.USER32 ref: 02B093CE
wsprintfA.USER32 ref: 02B0940C
wsprintfA.USER32 ref: 02B0948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02B094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02B09526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02B09571

Strings

runas, xrefs: 02B09674

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 10c1a945bd9d9841a970709bbf4e08c91c85d7753d09e00848f4d5076303f27c
Instruction ID: 44cfddbba6b6aea094490f370fcb6c8fe2c1a8187972cde749f6a9b34a0b5417
Opcode Fuzzy Hash: 10c1a945bd9d9841a970709bbf4e08c91c85d7753d09e00848f4d5076303f27c
Instruction Fuzzy Hash: E5A19FB1940648AFEB26DFA0CC85FDE3BACEB04B44F1004A6FE0592192D771D594CFA0

Function 02B0B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B0B467

Part of subcall function 02B0EF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 02B0EF92
Part of subcall function 02B0EF7C: lstrlenA.KERNEL32(?), ref: 02B0EF99
Part of subcall function 02B0EF7C: lstrlenA.KERNEL32(00000000), ref: 02B0EFA0

Strings

%M5DATE, xrefs: 02B0B50F
%FROM_DOMAIN, xrefs: 02B0B41E
%TO_USER, xrefs: 02B0B488
%FROM_USER, xrefs: 02B0B431
%P5DATE, xrefs: 02B0B4F2
%TO_DOMAIN, xrefs: 02B0B44B
%s@%s, xrefs: 02B0B461
%TO_HASH, xrefs: 02B0B4B0
%DATE, xrefs: 02B0B4D2
%TO_EMAIL, xrefs: 02B0B473
%FROM_EMAIL, xrefs: 02B0B3E9

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: e05b4bee913b1b8580d7ae01a3cdfcfdb21250efea7c41dadfad3e7d2b589c97
Instruction ID: d1f52f95dad595d2fa1c53a40053eebb0e7b4300c309493b75304bdcc50069c0
Opcode Fuzzy Hash: e05b4bee913b1b8580d7ae01a3cdfcfdb21250efea7c41dadfad3e7d2b589c97
Instruction Fuzzy Hash: 7B415EB254011C7EEF02BAA4CCC1DBFBF6DEF49648F144855FA05B2050DB31EA648BA1

Function 02B02011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B02078
GetTickCount.KERNEL32 ref: 02B020D4
GetTickCount.KERNEL32 ref: 02B020DB
GetTickCount.KERNEL32 ref: 02B0212B
GetTickCount.KERNEL32 ref: 02B02132
GetTickCount.KERNEL32 ref: 02B02142

Part of subcall function 02B0F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02B0E342,00000000,75A8EA50,80000001,00000000,02B0E513,?,00000000,00000000,?,000000E4), ref: 02B0F089
Part of subcall function 02B0F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02B0E342,00000000,75A8EA50,80000001,00000000,02B0E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02B0F093

Part of subcall function 02B0E854: lstrcpyA.KERNEL32(00000001,?,?,02B0D8DF,00000001,localcfg,except_info,00100000,02B10264), ref: 02B0E88B
Part of subcall function 02B0E854: lstrlenA.KERNEL32(00000001,?,02B0D8DF,00000001,localcfg,except_info,00100000,02B10264), ref: 02B0E899

Part of subcall function 02B01C5F: wsprintfA.USER32 ref: 02B01CE1

Strings

net_type, xrefs: 02B021DF
rbl_ip, xrefs: 02B0218F
rbl_bl, xrefs: 02B02181
localcfg, xrefs: 02B02070, 02B02160, 02B02186, 02B02194, 02B021E4

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 12a4347d0695e97d48155bd142620db29f402e6a2c2f420524f0a922038164c3
Instruction ID: a3df55e340aec5cf1384ee737846bd89b854c393ad2027902df2c81f006ccc87
Opcode Fuzzy Hash: 12a4347d0695e97d48155bd142620db29f402e6a2c2f420524f0a922038164c3
Instruction Fuzzy Hash: 7B5103B0E443065EE32EEF24ED89B2A3FD5EB00344F800899EE45C71D0EBB49498CA50

Function 02B0C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02B0A4C7: GetTickCount.KERNEL32 ref: 02B0A4D1
Part of subcall function 02B0A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 02B0A4FA

GetTickCount.KERNEL32 ref: 02B0C31F
GetTickCount.KERNEL32 ref: 02B0C32B
GetTickCount.KERNEL32 ref: 02B0C363
GetTickCount.KERNEL32 ref: 02B0C378
GetTickCount.KERNEL32 ref: 02B0C44D
InterlockedIncrement.KERNEL32(02B0C4E4), ref: 02B0C4AE
CreateThread.KERNEL32(00000000,00000000,02B0B535,00000000,?,02B0C4E0), ref: 02B0C4C1
CloseHandle.KERNEL32(00000000,?,02B0C4E0,02B13588,02B08810), ref: 02B0C4CC

Strings

localcfg, xrefs: 02B0C2DD

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: e25b331be03fd12da4fe5e684b6f056deb57ab7b1a7da8d21713e8842a8cd2d1
Instruction ID: b42478c66e8d30ac2494cbfd571384fea63ac91dde5172b924c20cae0db0b230
Opcode Fuzzy Hash: e25b331be03fd12da4fe5e684b6f056deb57ab7b1a7da8d21713e8842a8cd2d1
Instruction Fuzzy Hash: AC5168B1A00B418FD7259F69C5C462ABFE9FB48304B509E7EE58BC7A90E774E844CB14

Function 02B0BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02B0BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02B0BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02B0BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02B0BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02B0BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02B0BF94

Strings

smtp_retr, xrefs: 02B0BE61, 02B0BF8C
smtp_herr, xrefs: 02B0BE46, 02B0BF62
smtp_ban, xrefs: 02B0BE55, 02B0BF77

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 7899842464bf6e6e51c96246d4f9dd4318934471a89e2af0b80100b62175f7b3
Instruction ID: a21dc538871aa8d412e2834caafe7bc7a630b35ec77cee9b3ae06371129c4320
Opcode Fuzzy Hash: 7899842464bf6e6e51c96246d4f9dd4318934471a89e2af0b80100b62175f7b3
Instruction Fuzzy Hash: 3D516071A0461AEFDB129B64C9C0B5EBFA9EF0438CF4448D9ED45AB295D730E941CF90

Function 02B06A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,02B09A60,?,?,02B09E9D), ref: 02B06A7D
GetDiskFreeSpaceA.KERNEL32(02B09E9D,02B09A60,?,?,?,02B122F8,?,?,?,02B09A60,?,?,02B09E9D), ref: 02B06ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02B09A60,?,?,02B09E9D), ref: 02B06B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02B09A60,?,?,02B09E9D), ref: 02B06B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02B09A60,?,?,02B09E9D), ref: 02B06B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02B09A60,?,?,02B09E9D), ref: 02B06B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02B09A60,?,?,02B09E9D), ref: 02B06B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02B09A60,?,?,02B09E9D), ref: 02B06B80
GetLastError.KERNEL32(?,?,?,02B09A60,?,?,02B09E9D,?,?,?,?,?,02B09E9D,?,00000022,?), ref: 02B06B96

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 04a0bc918cd764fef029baa293de683a3cbf29bd8ca8e09a7b63d2b80dfb8bb0
Instruction ID: dfe3f41208052e287fdd70ee1fb93e44c54052bb34510b79d48e15abf234a94d
Opcode Fuzzy Hash: 04a0bc918cd764fef029baa293de683a3cbf29bd8ca8e09a7b63d2b80dfb8bb0
Instruction Fuzzy Hash: 2931F2B2D0014DAFDB02EFA08885ADE7F7DEF48350F5448A6EA11A7280D73096A4CF61

Function 02B06F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,02B0D7C3), ref: 02B06F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,02B0D7C3), ref: 02B06FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02B06FE8
LocalFree.KERNEL32(00000120), ref: 02B0701F
wsprintfA.USER32 ref: 02B07036

Strings

|, xrefs: 02B06FB3
/%d, xrefs: 02B07030

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 5b43641da2fad58b1157dcdba90fb7d9dc076ad59e315d619313f3854e5f4503
Instruction ID: ebe5767d0f51f97752f2da9f9cef51256ac50ccd4a105f589990d3154f6a4bb6
Opcode Fuzzy Hash: 5b43641da2fad58b1157dcdba90fb7d9dc076ad59e315d619313f3854e5f4503
Instruction Fuzzy Hash: 9A31FC72900219AFDB02DFA4D888EDA7FBCEF04354F1485A6F859DB140EB35E654CB94

Function 02B06CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,02B122F8,000000E4,02B06DDC,000000C8), ref: 02B06CE7
GetProcAddress.KERNEL32(00000000), ref: 02B06CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02B06D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02B06D2B

Strings

C:\Windows\SysWOW64\, xrefs: 02B06CC9, 02B06CD1, 02B06CFE, 02B06D05, 02B06D13, 02B06D1E, 02B06D2A, 02B06D42, 02B06D5F, 02B06D85
GetSystemWow64DirectoryA, xrefs: 02B06CDD
kernel32, xrefs: 02B06CE2

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 7747dc356d747b145e50336a4454f819766ec551c05b26485c52e361bf044514
Instruction ID: 0b839931dc6eb6c26b2bbf478319e85334c7329120d4b08b2407d761c8670446
Opcode Fuzzy Hash: 7747dc356d747b145e50336a4454f819766ec551c05b26485c52e361bf044514
Instruction Fuzzy Hash: 5C21F352B812647AF72766225CC8F6B3F4DCB42794F4909C4FC04AB0D1CB9585A582B9

Function 02B0977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02B09947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,02B122F8), ref: 02B097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,02B122F8), ref: 02B097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,02B122F8), ref: 02B097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,02B122F8), ref: 02B09831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,02B122F8), ref: 02B0984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,02B122F8), ref: 02B0985B

Strings

D, xrefs: 02B097A9

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: f7e22d1d36eac21c121da4253ad7f5ab150979d6882ba8bdf8a0955722e37883
Instruction ID: d3c4d85476cc033723363603a04572ee7d8c04b565a6be425bfd094fe077152f
Opcode Fuzzy Hash: f7e22d1d36eac21c121da4253ad7f5ab150979d6882ba8bdf8a0955722e37883
Instruction Fuzzy Hash: 9A213271D41119BBDB129FA1DC89FEF7F7CEF05694F400860F919E2190E7709694CAA0

Function 02B0E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02B0DD05: GetTickCount.KERNEL32 ref: 02B0DD0F
Part of subcall function 02B0DD05: InterlockedExchange.KERNEL32(02B136B4,00000001), ref: 02B0DD44
Part of subcall function 02B0DD05: GetCurrentThreadId.KERNEL32 ref: 02B0DD53

Part of subcall function 02B0DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 02B0DDB5

lstrcpynA.KERNEL32(?,02B01E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,02B0EAAA,?,?), ref: 02B0E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,02B0EAAA,?,?,00000001,?,02B01E84,?), ref: 02B0E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,02B0EAAA,?,?,00000001,?,02B01E84,?,0000000A), ref: 02B0E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,02B0EAAA,?,?,00000001,?,02B01E84,?), ref: 02B0E94F

Strings

flags_upd, xrefs: 02B0E8A7
localcfg, xrefs: 02B0E8AB

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 0302e25f2f6bf8794cfc09111f5a6a841e95d541e32eee9984c9c3db80dd9b8b
Instruction ID: 5d2ecce4e00651586a4f3e39ad2c9765e5349b134abedd904cc66af4466b9e06
Opcode Fuzzy Hash: 0302e25f2f6bf8794cfc09111f5a6a841e95d541e32eee9984c9c3db80dd9b8b
Instruction Fuzzy Hash: 66512F72D0020AAFCB11EFE8C9C49AEBBF9FF48304F14496AE515A7250D775EA548F50

Function 02B06BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02B06BB2

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 9846d0ab4da744caab10895751ab1c12cc625ff8103e74a6628947f4ded8e361
Instruction ID: b026fb2577a25ee237c8b857099552283b73650622c023b4be2fcf2813a071d7
Opcode Fuzzy Hash: 9846d0ab4da744caab10895751ab1c12cc625ff8103e74a6628947f4ded8e361
Instruction Fuzzy Hash: 61215E72904119FFDB226B60ED89E9F7FACDB043A4B104995F502E2080EB31DA60D664

Function 02B09064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,02B122F8), ref: 02B0907B
wsprintfA.USER32 ref: 02B090E9
CreateFileA.KERNEL32(02B122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B0910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02B09122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02B0912D
CloseHandle.KERNEL32(00000000), ref: 02B09134

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: adcc216bad6b9de9dc0a224b1f631b641f4b69e9eaec218018b1780aec5d3863
Instruction ID: 4850d60027e6647898f4946c2a5c67564dd54d267cefb161991aaa50a490c649
Opcode Fuzzy Hash: adcc216bad6b9de9dc0a224b1f631b641f4b69e9eaec218018b1780aec5d3863
Instruction Fuzzy Hash: 2B119DB2A401147BF7267631DC4DFAF3A6EDBC4B04F0488E5BF06E6090DA708E518B64

Function 02B0DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B0DD0F
GetCurrentThreadId.KERNEL32 ref: 02B0DD20
GetTickCount.KERNEL32 ref: 02B0DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,02B0E538,?,74DF0F10,?,00000000,?,02B0A445), ref: 02B0DD3B
InterlockedExchange.KERNEL32(02B136B4,00000001), ref: 02B0DD44
GetCurrentThreadId.KERNEL32 ref: 02B0DD53

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 7000611c01d5037c33d8d4e55616e23ebf84a8d7a382e27e9e48fb6bfe5b9590
Instruction ID: f8096660cb0d3bc176addff212f611ecb4b437175e51c0dace17f4943e461a52
Opcode Fuzzy Hash: 7000611c01d5037c33d8d4e55616e23ebf84a8d7a382e27e9e48fb6bfe5b9590
Instruction Fuzzy Hash: E3F0E972A88209DFC7416BE5A8C8B353FE5E7453D1F800D95E909C31C8D72450A5CF21

Function 02B0AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02B0AD1C
lstrlenA.KERNEL32(?), ref: 02B0AD60
lstrlenA.KERNEL32(?), ref: 02B0AD69
lstrcpyA.KERNEL32(?,LocalHost), ref: 02B0AD7F

Strings

LocalHost, xrefs: 02B0AD79

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 1eb07a646494569e12750b3ba85adb768f8b31b326f7c07e7cea00530c231135
Instruction ID: bfeac5bd758d9658a91d9a6edddec00188cb865920391ae7271d61bf0b067145
Opcode Fuzzy Hash: 1eb07a646494569e12750b3ba85adb768f8b31b326f7c07e7cea00530c231135
Instruction Fuzzy Hash: 8D01492088438D5EDF33163894C4BB93F6AEB8674AF404ED6E6C08B195EF2490838751

Function 02B04280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02B098FD,00000001,00000100,02B122F8,02B0A3C7), ref: 02B04290
CloseHandle.KERNEL32(02B0A3C7), ref: 02B043AB
CloseHandle.KERNEL32(00000001), ref: 02B043AE

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: e129f0f74d021e88b138f9cca8e603083f8d59640806a2b1cb4552ac66d3d052
Instruction ID: e42f7a1af33c6d340f1fe296a23e30a2f5a4df272e02bea257c90e6b41bcfe7f
Opcode Fuzzy Hash: e129f0f74d021e88b138f9cca8e603083f8d59640806a2b1cb4552ac66d3d052
Instruction Fuzzy Hash: 50418D71D00209BBDB12ABA1DDC9FAFBFB9EF40364F1045A5F614A21C0DB349650CBA0

Function 02B06069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,02B064CF,00000000), ref: 02B0609C
LoadLibraryA.KERNEL32(?,?,02B064CF,00000000), ref: 02B060C3
GetProcAddress.KERNEL32(?,00000014), ref: 02B0614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02B0619E

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 9530bfee249132ba25285338626b2767509f9e2ab6f408bcdb710c15cdc9f8e9
Instruction ID: 951f30fdda8403872f796dba3064e3ebf4e4982bad3c986f6dce264eab3733ab
Opcode Fuzzy Hash: 9530bfee249132ba25285338626b2767509f9e2ab6f408bcdb710c15cdc9f8e9
Instruction Fuzzy Hash: 68415C71E00106AFDB15CF54C8C4B69BBB9EF04358F1494A9E815D72D1E730EEA0CB90

Function 02B02923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653db33c9b1f363bfff7100facd5c21dcff2933f4a555a10769b75055346c3d4
Instruction ID: e74130b74990f6829b89b67e12349a59d710b95f0a0c4844c1531c3798cf7c0a
Opcode Fuzzy Hash: 653db33c9b1f363bfff7100facd5c21dcff2933f4a555a10769b75055346c3d4
Instruction Fuzzy Hash: 4B31B171900318ABDB129FA5CCC5BBEBBF4EF48705F104896E914E7280E774D6958B64

Function 02B026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B0272E
htons.WS2_32(00000001), ref: 02B02752
htons.WS2_32(0000000F), ref: 02B027D5
htons.WS2_32(00000001), ref: 02B027E3
sendto.WS2_32(?,02B12BF8,00000009,00000000,00000010,00000010), ref: 02B02802

Part of subcall function 02B0EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02B0EBFE,7FFF0001,?,02B0DB55,7FFF0001), ref: 02B0EBD3
Part of subcall function 02B0EBCC: RtlAllocateHeap.NTDLL(00000000,?,02B0DB55,7FFF0001), ref: 02B0EBDA

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 3d585302d924dc9511924c3d16620aca749673c0c492fc0fb573703a925dfad5
Instruction ID: 4e8232ebd73bfda4d14d25f71814c177b8e6cbb8a6eab3cc7a1397e4beb818a2
Opcode Fuzzy Hash: 3d585302d924dc9511924c3d16620aca749673c0c492fc0fb573703a925dfad5
Instruction Fuzzy Hash: EA316D346803A69FD711DF74D8C0A627B60EF19358B5948EDEC59CB352D732E896CB10

Function 02B09145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,02B122F8), ref: 02B0915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02B09166
CharToOemA.USER32(?,?), ref: 02B09174
wsprintfA.USER32 ref: 02B091A9

Part of subcall function 02B09064: GetTempPathA.KERNEL32(00000400,?,00000000,02B122F8), ref: 02B0907B
Part of subcall function 02B09064: wsprintfA.USER32 ref: 02B090E9
Part of subcall function 02B09064: CreateFileA.KERNEL32(02B122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B0910E
Part of subcall function 02B09064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02B09122
Part of subcall function 02B09064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02B0912D
Part of subcall function 02B09064: CloseHandle.KERNEL32(00000000), ref: 02B09134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02B091E1

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: b0bea6007a6dd4018e89b98eecf6cb7b9ea295fa1317eb800fe138130a19b058
Instruction ID: 8ca95d2e2bbf09220eea2579cac67be44b53a2d924724461caf5ca35d00a6878
Opcode Fuzzy Hash: b0bea6007a6dd4018e89b98eecf6cb7b9ea295fa1317eb800fe138130a19b058
Instruction Fuzzy Hash: 350140F6940118BBDB21A6619D8DFDF7B7CDB95B01F4008A1BF49E2080EA7496D58F70

Function 02B02419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02B02491,?,?,?,02B0E844,-00000030,?,?,?,00000001), ref: 02B02429
lstrlenA.KERNEL32(?,?,02B02491,?,?,?,02B0E844,-00000030,?,?,?,00000001,02B01E3D,00000001,localcfg,lid_file_upd), ref: 02B0243E
lstrcmpiA.KERNEL32(?,?), ref: 02B02452
lstrlenA.KERNEL32(?,?,02B02491,?,?,?,02B0E844,-00000030,?,?,?,00000001,02B01E3D,00000001,localcfg,lid_file_upd), ref: 02B02467

Strings

localcfg, xrefs: 02B0241F

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 132e8dcdce9ee1073e43f4222d1c6b57876009f65be6edeb1a13f9da5250ea39
Instruction ID: 4aafc06a62c5f11cd4f22ff6be9838e52bb9308c296e25f89b45b974ee94a75d
Opcode Fuzzy Hash: 132e8dcdce9ee1073e43f4222d1c6b57876009f65be6edeb1a13f9da5250ea39
Instruction Fuzzy Hash: 8301DA31A00218EFCF12EF69DC889DE7BA9EF44398B45C465ED5997201E330EA549B90

Function 02B01C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B01CE1
wsprintfA.USER32 ref: 02B01D6B

Strings

%u.%u.%u.%u.%s, xrefs: 02B01CDB, 02B01D65
localcfg, xrefs: 02B01C70

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 8661a41982932317baad65a88fa226a2f9012ee1d5ed83eb167914c53a039597
Instruction ID: 222196cdbaa15854fc5c08d0193323647c56b664f4cadc57b969d1d7c245991e
Opcode Fuzzy Hash: 8661a41982932317baad65a88fa226a2f9012ee1d5ed83eb167914c53a039597
Instruction Fuzzy Hash: 03418C729042999FDB26DFB88884BEE7FE99F49310F240596FD64D3191D634D604CBA0

Function 02B0E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02B0DD05: GetTickCount.KERNEL32 ref: 02B0DD0F
Part of subcall function 02B0DD05: InterlockedExchange.KERNEL32(02B136B4,00000001), ref: 02B0DD44
Part of subcall function 02B0DD05: GetCurrentThreadId.KERNEL32 ref: 02B0DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,02B05EC1), ref: 02B0E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,02B05EC1), ref: 02B0E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,74DF0F10,00000000,?,02B05EC1), ref: 02B0E722

Strings

89ABCDEF, xrefs: 02B0E721

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 7b94dcdc8905330a21245020401b001c157807ef52706ec8abdaf946a2d235dc
Instruction ID: 652d95be141e41b9153c48c606e031791df325600e2168602ded46a23a0dfb12
Opcode Fuzzy Hash: 7b94dcdc8905330a21245020401b001c157807ef52706ec8abdaf946a2d235dc
Instruction Fuzzy Hash: DA31AF31A00715DBCB328EA4E8C87667FE4EB01354F104DAAE955875C1D770E880CB91

Function 02B0E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02B0E2A3,00000000,00000000,00000000,00020106,00000000,02B0E2A3,00000000,000000E4), ref: 02B0E0B2
RegSetValueExA.ADVAPI32(02B0E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,02B122F8), ref: 02B0E127
RegDeleteValueA.ADVAPI32(02B0E2A3,?,?,?,?,?,000000C8,02B122F8), ref: 02B0E158
RegCloseKey.ADVAPI32(02B0E2A3,?,?,?,?,000000C8,02B122F8,?,?,?,?,?,?,?,?,02B0E2A3), ref: 02B0E161

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 0dd646b47ca22f2a735a65c1d1f072f93833f4d3dc1a9a0d70ad5466c9e59b73
Instruction ID: 7be6d495fde2eed68ea4b85e02c3f9a8fad74e903ce0309d861a1b53ce1592db
Opcode Fuzzy Hash: 0dd646b47ca22f2a735a65c1d1f072f93833f4d3dc1a9a0d70ad5466c9e59b73
Instruction Fuzzy Hash: 4D215E71E0021DBBDF219EA4DC89EDE7F79EF09790F0084A1F905A6190E771CA94CB90

Function 02B03F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,02B0A3C7,00000000,00000000,000007D0,00000001), ref: 02B03FB8
GetLastError.KERNEL32 ref: 02B03FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02B03FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B03FE6

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 176c5741c0bcdf9301fd09b15ac80bc04184351c2ffc7aabd257079ead9353ca
Instruction ID: 6f42f57da555b9a138890d3a640ccef9a08bc509e2e6814c1844da07fc46fb53
Opcode Fuzzy Hash: 176c5741c0bcdf9301fd09b15ac80bc04184351c2ffc7aabd257079ead9353ca
Instruction Fuzzy Hash: E901977291010AAFDF12DF94D989BEE7BBCEF04355F504491FD06E2090D7719A648BA1

Function 02B03F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,02B0A3C7,00000000,00000000,000007D0,00000001), ref: 02B03F44
GetLastError.KERNEL32 ref: 02B03F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02B03F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B03F72

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: f2d0a9b4b35679f11e0349a9f4f221ea315f55568775e2ec92cbe9503162d02d
Instruction ID: ffd2522b86a506be5388026cc255b36f874e64034be7c05cd6560939faf31a62
Opcode Fuzzy Hash: f2d0a9b4b35679f11e0349a9f4f221ea315f55568775e2ec92cbe9503162d02d
Instruction Fuzzy Hash: BE019772915109ABDB12DF90D988BEE7BBCEB04395F5044A6FA01E2080D7709A658BA1

Function 02B04E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B04E9E
GetTickCount.KERNEL32 ref: 02B04EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02B04EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02B04EC3

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ff19d76640d2579f872b6980103f44a5177720f3c91d9c71a7e70edd9709383
Instruction ID: d3401482bc8851f0cab162b9c2f8b58b4bbbf67ef74d507b7281a315294c3d4e
Opcode Fuzzy Hash: 1ff19d76640d2579f872b6980103f44a5177720f3c91d9c71a7e70edd9709383
Instruction Fuzzy Hash: E8E0867664121897D61036B9ACC8F677A599B453E1F410DB1FB09D3180C65694A245B1

Function 02B0A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B0A4D1
GetTickCount.KERNEL32 ref: 02B0A4E4
Sleep.KERNEL32(00000000,?,02B0C2E9,02B0C4E0,00000000,localcfg,?,02B0C4E0,02B13588,02B08810), ref: 02B0A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 02B0A4FA

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 2e783be77090d73b5e7b63c03c36a0de0ae418cdf477d112cff66e84d38343cc
Instruction ID: 6086af61d02ad5d67c984c4f357c9d536222f322633faf045f2e14acc95c950e
Opcode Fuzzy Hash: 2e783be77090d73b5e7b63c03c36a0de0ae418cdf477d112cff66e84d38343cc
Instruction Fuzzy Hash: 9BE0263724030857C60077A5ACC8F6E3B88EB497A1F460CA1FF08E3180C616A59182B2

Function 02B04BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B04BDD
GetTickCount.KERNEL32 ref: 02B04BEC
Sleep.KERNEL32(00000000,?,?,?,02E1B12C,02B050F2), ref: 02B04BF9
InterlockedExchange.KERNEL32(02E1B120,00000001), ref: 02B04C02

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 63a21f61fcbee2904dea08936f2bf9314d856e34321e6e57c9a1d53030025348
Instruction ID: bb8264e83dbb0a3db9e4287bb0fa9b449e72877811fc561542e793189989c6f5
Opcode Fuzzy Hash: 63a21f61fcbee2904dea08936f2bf9314d856e34321e6e57c9a1d53030025348
Instruction Fuzzy Hash: 6AE0CD3768121C57C71036B65DC4F667B6CDB453A1F460CB2FF0DD3180C956D49142B1

Function 02B030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B03103
GetTickCount.KERNEL32 ref: 02B0310F
Sleep.KERNEL32(00000000), ref: 02B0311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02B03128

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: a68ed833e27a870a2dc0eaf92138a41b776a3e44e57b151fe04bef4c52102c62
Instruction ID: 5fbbacdcd0193cbfb3f0ea308c090c55aab4ca1d07769bbccf830d8caa099a62
Opcode Fuzzy Hash: a68ed833e27a870a2dc0eaf92138a41b776a3e44e57b151fe04bef4c52102c62
Instruction Fuzzy Hash: 08E0C235640219ABDB007B75ADCDB496E9ADF887A1F010CB1FA05D30D0CAA08CA18A71

Function 02B08CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B08D02
GetTickCount.KERNEL32 ref: 02B08DA1

Strings

localcfg, xrefs: 02B08D19

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 5f924798e6f828278a13f0311152a5dc6001beb57840130a377cf6899d3f0fe0
Instruction ID: 34a08a712e6e1c3aadb9a8f19822b432f2aa0c0327c58929541edc98a8aea101
Opcode Fuzzy Hash: 5f924798e6f828278a13f0311152a5dc6001beb57840130a377cf6899d3f0fe0
Instruction Fuzzy Hash: BB21D232A10215AFCB11DFA8E8C465ABFBAFF20254B6547DDD401D7191DB30EA40CB54

Function 02B0BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B0BFD0
wsprintfA.USER32 ref: 02B0C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 02B0C057

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 52a706f7470082bc36fedaa96198cea33eb157af41a80171d431441ef5d09730
Instruction ID: ba2d5eb5767b77db8a1331ad67bc20dfc41d17568358332727916de87123a72e
Opcode Fuzzy Hash: 52a706f7470082bc36fedaa96198cea33eb157af41a80171d431441ef5d09730
Instruction Fuzzy Hash: 17119772500100FFDB429AA9CD48E567FA6FF88358B34859CF6188E126D633D863EB50

Function 02B026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 02B026C3
inet_ntoa.WS2_32(?), ref: 02B026E4

Strings

localcfg, xrefs: 02B026CD, 02B026D2, 02B026DE

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 3d75034b7ae7e54e2213ff29a025ec49b0fce45da27d69ece52ce86f29752707
Instruction ID: 46b73814edd3407c4707c58841c0c785cf531e0c68558f2bb93cdc5b71e648bd
Opcode Fuzzy Hash: 3d75034b7ae7e54e2213ff29a025ec49b0fce45da27d69ece52ce86f29752707
Instruction Fuzzy Hash: 9AF082321482096BEF056EA0EC49AAA3B9CDB09254F104861FD08CA0D0DB71E9508798

Function 02B0EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,02B0EB54,_alldiv,02B0F0B7,80000001,00000000,00989680,00000000,?,?,?,02B0E342,00000000,75A8EA50,80000001,00000000), ref: 02B0EAF2
GetProcAddress.KERNEL32(76E90000,00000000), ref: 02B0EB07

Strings

ntdll.dll, xrefs: 02B0EAED

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: c758a702d44abec3d309267a1b5a6518fa5af9c893b534bf357534ce8f7a141f
Instruction ID: c64209f54ea1f666d5f6cde82579d3fd848c84d51da353a11cb3fcb47618019f
Opcode Fuzzy Hash: c758a702d44abec3d309267a1b5a6518fa5af9c893b534bf357534ce8f7a141f
Instruction Fuzzy Hash: 12D0C934E843039B9F125F68999EE057AECEB50781BC04C95B80AE3110E735E5A4DA00

Function 02B02F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02B02D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,02B02F01,?,02B020FF,02B12000), ref: 02B02D3A
Part of subcall function 02B02D21: LoadLibraryA.KERNEL32(?), ref: 02B02D4A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B02F73
HeapFree.KERNEL32(00000000), ref: 02B02F7A

Memory Dump Source

Source File: 0000000E.00000002.4190900225.0000000002B00000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B00000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2b00000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 36b743504096f45ca689a2be707ff0510ce245f3b6f8e32f11630114a784cf73
Instruction ID: 5f0f5f04366cb45b572b5e869f08326086f7eca7d0b201bcd69d25c60e81b7ac
Opcode Fuzzy Hash: 36b743504096f45ca689a2be707ff0510ce245f3b6f8e32f11630114a784cf73
Instruction Fuzzy Hash: 53519E7190020A9FDF06AF64D888AFABBB5FF05344F1045A9EC96D7250E732DA59CB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AvDJi40xp_9fyz7RPmKdbxb4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\lfkidgdf.exe

C:\Windows\SysWOW64\qeuwztgf\lfkidgdf.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
AvDJi40xp_9fyz7RPmKdbxb4.exe

Function 00409326 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 284
registryCOMMON

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre