Edit tour

Windows Analysis Report
vyrcclmm.exe

Overview

General Information

Sample name:	vyrcclmm.exe
Analysis ID:	1468508
MD5:	52d6521fdf86ef42b47afa05bf06225f
SHA1:	ffe1dca080b60cac20e6d2dcba807388badde68f
SHA256:	039bcb175a6042892395691ef543d82135ff3e0542cc18a30b791d20d205b966
Tags:	exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Query firmware table information (likely to detect VMs)

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Use Short Name Path in Command Line

Sigma detected: Windows Defender Exclusions Added - Registry

Uses SMTP (mail sending)

Yara signature match

Classification

Process Tree

System is w10x64

vyrcclmm.exe (PID: 6316 cmdline: "C:\Users\user\Desktop\vyrcclmm.exe" MD5: 52D6521FDF86EF42B47AFA05BF06225F)

cmd.exe (PID: 4536 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bzycpcet\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4512 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\bzycpcet\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2684 cmdline: "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 2920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1000 cmdline: "C:\Windows\System32\sc.exe" description bzycpcet "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 5444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1836 cmdline: "C:\Windows\System32\sc.exe" start bzycpcet MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 1428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2644 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 2232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4428 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3736 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6148 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 1452 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5916 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6880 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1476 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 2168 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 4268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

pspizbvl.exe (PID: 7016 cmdline: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d"C:\Users\user\Desktop\vyrcclmm.exe" MD5: 38DF4E4C47840B37306FF102DD07903D)

svchost.exe (PID: 2132 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

svchost.exe (PID: 6380 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1624 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.3694703474.00000000028E2000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4d8e:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000014.00000002.1689220789.00000000029ED000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x47d6:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: vyrcclmm.exe PID: 6316	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: pspizbvl.exe PID: 7016	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 2132	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.vyrcclmm.exe.29c0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.vyrcclmm.exe.29c0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
20.3.pspizbvl.exe.3130000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
20.3.pspizbvl.exe.3130000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.vyrcclmm.exe.4460000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.vyrcclmm.exe.4460000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
20.2.pspizbvl.exe.29b0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
20.2.pspizbvl.exe.29b0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
24.2.svchost.exe.450000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
24.2.svchost.exe.450000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
24.2.svchost.exe.450000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.vyrcclmm.exe.29c0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.vyrcclmm.exe.29c0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.vyrcclmm.exe.29c0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
20.2.pspizbvl.exe.3130000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
20.2.pspizbvl.exe.3130000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
20.2.pspizbvl.exe.3130000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
20.2.pspizbvl.exe.3130000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
20.2.pspizbvl.exe.3130000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
20.2.pspizbvl.exe.3130000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
20.2.pspizbvl.exe.29b0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
20.2.pspizbvl.exe.29b0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
20.2.pspizbvl.exe.29b0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
20.2.pspizbvl.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
20.2.pspizbvl.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
20.2.pspizbvl.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
20.2.pspizbvl.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
20.2.pspizbvl.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
20.2.pspizbvl.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.vyrcclmm.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.vyrcclmm.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.vyrcclmm.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.vyrcclmm.exe.4460000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.vyrcclmm.exe.4460000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.vyrcclmm.exe.4460000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.vyrcclmm.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.vyrcclmm.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.vyrcclmm.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
20.3.pspizbvl.exe.3130000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
20.3.pspizbvl.exe.3130000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
20.3.pspizbvl.exe.3130000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
24.2.svchost.exe.450000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
24.2.svchost.exe.450000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
24.2.svchost.exe.450000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d"C:\Users\user\Desktop\vyrcclmm.exe", ParentImage: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, ParentProcessId: 7016, ParentProcessName: pspizbvl.exe, ProcessCommandLine: svchost.exe, ProcessId: 2132, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\vyrcclmm.exe", ParentImage: C:\Users\user\Desktop\vyrcclmm.exe, ParentProcessId: 6316, ParentProcessName: vyrcclmm.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2684, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.11.0, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 2132, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d"C:\Users\user\Desktop\vyrcclmm.exe", ParentImage: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, ParentProcessId: 7016, ParentProcessName: pspizbvl.exe, ProcessCommandLine: svchost.exe, ProcessId: 2132, ProcessName: svchost.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\bzycpcet\, CommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\bzycpcet\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\vyrcclmm.exe", ParentImage: C:\Users\user\Desktop\vyrcclmm.exe, ParentProcessId: 6316, ParentProcessName: vyrcclmm.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\bzycpcet\, ProcessId: 4512, ProcessName: cmd.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 2132, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\bzycpcet

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\vyrcclmm.exe", ParentImage: C:\Users\user\Desktop\vyrcclmm.exe, ParentProcessId: 6316, ParentProcessName: vyrcclmm.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2684, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 4428, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: vanaheim.cn:443

Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0.2.vyrcclmm.exe.29c0e67.1.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for domain / URL

Source: jotunheim.name	Virustotal: Detection: 13%	Perma Link
Source: vanaheim.cn	Virustotal: Detection: 17%	Perma Link
Source: jotunheim.name:443	Virustotal: Detection: 12%	Perma Link
Source: vanaheim.cn:443	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for submitted file

Source: vyrcclmm.exe

Virustotal: Detection: 43%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\pspizbvl.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: vyrcclmm.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\vyrcclmm.exe	Unpacked PE file: 0.2.vyrcclmm.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Unpacked PE file: 20.2.pspizbvl.exe.400000.0.unpack

Source: C:\Users\user\Desktop\vyrcclmm.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\bzycpcet

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.133.13.231 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 173.194.76.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.77 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.72 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 80.66.75.11 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.11.0 52.101.11.0
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 67.195.204.77 67.195.204.77
Source: Joe Sandbox View	IP Address: 67.195.204.72 67.195.204.72

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU
Source: Joe Sandbox View	ASN Name: YAHOO-3US YAHOO-3US
Source: Joe Sandbox View	ASN Name: YAHOO-3US YAHOO-3US

Source: global traffic	TCP traffic: 192.168.2.7:49705 -> 52.101.11.0:25
Source: global traffic	TCP traffic: 192.168.2.7:49707 -> 67.195.204.72:25
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 173.194.76.26:25
Source: global traffic	TCP traffic: 192.168.2.7:49713 -> 94.100.180.31:25
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 104.47.54.36:25
Source: global traffic	TCP traffic: 192.168.2.7:49719 -> 67.195.204.77:25
Source: global traffic	TCP traffic: 192.168.2.7:49722 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru
Source: global traffic	DNS traffic detected: DNS query: jotunheim.name

Source: svchost.exe, 0000000D.00000002.3693187786.000002CE7C287000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3694275058.000002CE7CB02000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.13.dr	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
Source: svchost.exe, 00000002.00000002.1426700791.0000026366213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.comc
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000002.1426886129.0000026366270000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1414299016.000002636625A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426791972.0000026366244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1392924123.0000026366262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1385716596.000002636626E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000002.00000002.1426870101.0000026366268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390205159.0000026366267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000002.00000002.1426886129.0000026366270000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1385716596.000002636626E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.1414299016.000002636625A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1392924123.0000026366262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000002.00000002.1426870101.0000026366268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390205159.0000026366267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426727211.000002636622B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000002.00000003.1392924123.0000026366262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426727211.000002636622B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000002.00000002.1426775775.0000026366241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000002.1426791972.0000026366244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1392924123.0000026366262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000002.00000003.1383970177.0000026366234000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000002.1426775775.0000026366241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000003.1392924123.0000026366262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000002.00000002.1426791972.0000026366244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1401912422.000002636625E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000002.00000003.1383970177.0000026366234000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000002.1426870101.0000026366268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390205159.0000026366267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426727211.000002636622B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000003.1410254879.000002636625D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000002.00000002.1426727211.000002636622B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 24.2.svchost.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vyrcclmm.exe.29c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.3130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.3130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vyrcclmm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.vyrcclmm.exe.4460000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vyrcclmm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.pspizbvl.exe.3130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.svchost.exe.450000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vyrcclmm.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pspizbvl.exe PID: 7016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2132, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.vyrcclmm.exe.29c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.vyrcclmm.exe.29c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 20.3.pspizbvl.exe.3130000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 20.3.pspizbvl.exe.3130000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.vyrcclmm.exe.4460000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.vyrcclmm.exe.4460000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 20.2.pspizbvl.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 20.2.pspizbvl.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 24.2.svchost.exe.450000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 24.2.svchost.exe.450000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.vyrcclmm.exe.29c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.vyrcclmm.exe.29c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 20.2.pspizbvl.exe.3130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 20.2.pspizbvl.exe.3130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 20.2.pspizbvl.exe.3130000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 20.2.pspizbvl.exe.3130000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 20.2.pspizbvl.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 20.2.pspizbvl.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 20.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 20.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 20.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 20.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.vyrcclmm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.vyrcclmm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.vyrcclmm.exe.4460000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.vyrcclmm.exe.4460000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.vyrcclmm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.vyrcclmm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 20.3.pspizbvl.exe.3130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 20.3.pspizbvl.exe.3130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 24.2.svchost.exe.450000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 24.2.svchost.exe.450000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.3694703474.00000000028E2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000014.00000002.1689220789.00000000029ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\vyrcclmm.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,LocalAlloc,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\bzycpcet\

Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Code function: 20_2_0040C913	20_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 24_2_0045C913	24_2_0045C913

Source: C:\Users\user\Desktop\vyrcclmm.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\vyrcclmm.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\Desktop\vyrcclmm.exe	Code function: String function: 029C27AB appears 35 times

Source: vyrcclmm.exe, 00000000.00000002.3693491534.0000000002815000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesAtlassing0 vs vyrcclmm.exe
Source: vyrcclmm.exe, 00000000.00000002.3694830598.0000000002945000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesc.exej% vs vyrcclmm.exe
Source: vyrcclmm.exe, 00000000.00000002.3694830598.0000000002928000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesAtlassing0 vs vyrcclmm.exe
Source: vyrcclmm.exe	Binary or memory string: OriginalFilenamesAtlassing0 vs vyrcclmm.exe

Source: 0.2.vyrcclmm.exe.29c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.vyrcclmm.exe.29c0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 20.3.pspizbvl.exe.3130000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 20.3.pspizbvl.exe.3130000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.vyrcclmm.exe.4460000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.vyrcclmm.exe.4460000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 20.2.pspizbvl.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 20.2.pspizbvl.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 24.2.svchost.exe.450000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 24.2.svchost.exe.450000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.vyrcclmm.exe.29c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.vyrcclmm.exe.29c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 20.2.pspizbvl.exe.3130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 20.2.pspizbvl.exe.3130000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 20.2.pspizbvl.exe.3130000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 20.2.pspizbvl.exe.3130000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 20.2.pspizbvl.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 20.2.pspizbvl.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 20.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 20.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 20.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 20.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.vyrcclmm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.vyrcclmm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.vyrcclmm.exe.4460000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.vyrcclmm.exe.4460000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.vyrcclmm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.vyrcclmm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 20.3.pspizbvl.exe.3130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 20.3.pspizbvl.exe.3130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 24.2.svchost.exe.450000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 24.2.svchost.exe.450000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.3694703474.00000000028E2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000014.00000002.1689220789.00000000029ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: classification engine

Classification label: mal100.troj.evad.winEXE@34/6@14/9

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_028E6DBC CreateToolhelp32Snapshot,Module32First,

0_2_028E6DBC

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\vyrcclmm.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Code function: 20_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	20_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 24_2_00459A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	24_2_00459A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2232:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4268:120:WilError_03

Source: C:\Users\user\Desktop\vyrcclmm.exe

File created: C:\Users\user~1\AppData\Local\Temp\pspizbvl.exe

Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vyrcclmm.exe

Virustotal: Detection: 43%

Source: C:\Users\user\Desktop\vyrcclmm.exe

File read: C:\Users\user\Desktop\vyrcclmm.exe

Jump to behavior

Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_20-14590
Source: C:\Users\user\Desktop\vyrcclmm.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_0-14479

Source: unknown	Process created: C:\Users\user\Desktop\vyrcclmm.exe "C:\Users\user\Desktop\vyrcclmm.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bzycpcet\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\bzycpcet\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description bzycpcet "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start bzycpcet
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d"C:\Users\user\Desktop\vyrcclmm.exe"
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bzycpcet\	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\bzycpcet\	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description bzycpcet "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start bzycpcet	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: vyrcclmm.exe

Static file information: File size 10890752 > 1048576

Source: C:\Users\user\Desktop\vyrcclmm.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\vyrcclmm.exe	Unpacked PE file: 0.2.vyrcclmm.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Unpacked PE file: 20.2.pspizbvl.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\vyrcclmm.exe	Unpacked PE file: 0.2.vyrcclmm.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Unpacked PE file: 20.2.pspizbvl.exe.400000.0.unpack

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe

Source: C:\Users\user\Desktop\vyrcclmm.exe	File created: C:\Users\user\AppData\Local\Temp\pspizbvl.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe (copy)

Jump to dropped file

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\vyrcclmm.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support"

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

24_2_0045199C

Source: C:\Windows\SysWOW64\svchost.exe

Window / User API: threadDelayed 716

Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15434
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_20-14986
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_24-7604

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_24-6139

Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_20-14966
Source: C:\Users\user\Desktop\vyrcclmm.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-14925
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_24-7326

Source: C:\Users\user\Desktop\vyrcclmm.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-14495
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_20-14605

Source: C:\Users\user\Desktop\vyrcclmm.exe	API coverage: 6.1 %
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	API coverage: 4.6 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 1836	Thread sleep count: 716 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 1836	Thread sleep time: -716000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 1836	Thread sleep count: 163 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 1836	Thread sleep time: -163000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000009.00000002.3692737951.000002266A42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000018.00000002.3692735595.0000000002A00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllYc
Source: svchost.exe, 00000009.00000002.3692737951.000002266A42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.3693748237.000002266A480000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.3693748237.000002266A466000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:odul
Source: svchost.exe, 00000009.00000002.3693748237.000002266A466000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000009.00000002.3691899523.000002266A402000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000009.00000002.3694320773.000002266A502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.3692737951.000002266A42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000009.00000002.3693188714.000002266A44D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000017.00000002.3692836823.0000024941A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\vyrcclmm.exe	API call chain: ExitProcess graph end node			graph_0-14928
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	API call chain: ExitProcess graph end node			graph_20-14978

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe

Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep

graph_24-7491

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\vyrcclmm.exe	Code function: 0_2_028E6699 push dword ptr fs:[00000030h]	0_2_028E6699
Source: C:\Users\user\Desktop\vyrcclmm.exe	Code function: 0_2_029C0D90 mov eax, dword ptr fs:[00000030h]	0_2_029C0D90
Source: C:\Users\user\Desktop\vyrcclmm.exe	Code function: 0_2_029C092B mov eax, dword ptr fs:[00000030h]	0_2_029C092B
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Code function: 20_2_029B0D90 mov eax, dword ptr fs:[00000030h]	20_2_029B0D90
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Code function: 20_2_029B092B mov eax, dword ptr fs:[00000030h]	20_2_029B092B
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Code function: 20_2_029F10E1 push dword ptr fs:[00000030h]	20_2_029F10E1

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\vyrcclmm.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Code function: 20_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	20_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 24_2_00459A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	24_2_00459A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.133.13.231 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 173.194.76.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.77 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.72 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 80.66.75.11 443	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 450000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 450000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 450000			Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 335008			Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bzycpcet\	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\bzycpcet\	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description bzycpcet "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start bzycpcet	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\vyrcclmm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vyrcclmm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\vyrcclmm.exe

0_2_00407809

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\vyrcclmm.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,VirtualProtect,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\Desktop\vyrcclmm.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\vyrcclmm.exe

Source: svchost.exe, 0000000F.00000002.3695104345.000001D4A3D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Files%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000F.00000002.3695104345.000001D4A3D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 24.2.svchost.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vyrcclmm.exe.29c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.3130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.3130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vyrcclmm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.vyrcclmm.exe.4460000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vyrcclmm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.pspizbvl.exe.3130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.svchost.exe.450000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vyrcclmm.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pspizbvl.exe PID: 7016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2132, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 24.2.svchost.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vyrcclmm.exe.29c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.3130000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.3130000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vyrcclmm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.vyrcclmm.exe.4460000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vyrcclmm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.pspizbvl.exe.3130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.svchost.exe.450000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vyrcclmm.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pspizbvl.exe PID: 7016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2132, type: MEMORYSTR

Source: C:\Users\user\Desktop\vyrcclmm.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe	Code function: 20_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	20_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 24_2_004588B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	24_2_004588B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	4 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	41 Native API	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	14 Windows Service	1 Access Token Manipulation	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Service Execution	Login Hook	14 Windows Service	2 Software Packing	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Masquerading	Cached Domain Credentials	23 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	23 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	412 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vyrcclmm.exe	43%	Virustotal		Browse
vyrcclmm.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\pspizbvl.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
mxs.mail.ru	0%	Virustotal	Browse
mta5.am0.yahoodns.net	0%	Virustotal	Browse
jotunheim.name	14%	Virustotal	Browse
microsoft-com.mail.protection.outlook.com	0%	Virustotal	Browse
vanaheim.cn	17%	Virustotal	Browse
yahoo.com	0%	Virustotal	Browse
google.com	0%	Virustotal	Browse
mail.ru	0%	Virustotal	Browse
smtp.google.com	0%	Virustotal	Browse
time.windows.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/REST/v1/Routes/	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Routes/Driving	0%	Avira URL Cloud	safe
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	0%	Virustotal		Browse
https://dev.virtualearth.net/REST/v1/Routes/Driving	0%	Virustotal		Browse
https://dev.ditu.live.com/REST/v1/Transit/Stops/	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Routes/	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	0%	Avira URL Cloud	safe
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	0%	Virustotal		Browse
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	0%	Virustotal		Browse
https://dev.virtualearth.net/REST/v1/Routes/Walking	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Routes/	0%	Virustotal		Browse
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	0%	Virustotal		Browse
https://dev.ditu.live.com/REST/v1/Transit/Stops/	0%	Virustotal		Browse
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	0%	Virustotal		Browse
https://dev.ditu.live.com/REST/v1/Routes/	0%	Virustotal		Browse
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	0%	Virustotal		Browse
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	0%	Virustotal		Browse
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Locations	0%	Avira URL Cloud	safe
https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/	0%	Avira URL Cloud	safe
jotunheim.name:443	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/mapcontrol/logging.ashx	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	0%	Avira URL Cloud	safe
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	0%	Avira URL Cloud	safe
jotunheim.name:443	13%	Virustotal		Browse
https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/	0%	Virustotal		Browse
https://dev.ditu.live.com/mapcontrol/logging.ashx	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Locations	0%	Virustotal		Browse
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	0%	Virustotal		Browse
https://dev.virtualearth.net/mapcontrol/logging.ashx	0%	Virustotal		Browse
https://dev.virtualearth.net/REST/v1/Routes/Walking	0%	Virustotal		Browse
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	0%	Avira URL Cloud	safe
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	0%	Virustotal		Browse
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	0%	Avira URL Cloud	safe
vanaheim.cn:443	100%	Avira URL Cloud	phishing
https://dynamic.t	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/mapcontrol/logging.ashx	0%	Virustotal		Browse
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	0%	Virustotal		Browse
http://www.bingmapsportal.comc	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	0%	Virustotal		Browse
https://dev.virtualearth.net/REST/v1/Routes/Transit	0%	Avira URL Cloud	safe
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	0%	Virustotal		Browse
vanaheim.cn:443	8%	Virustotal		Browse
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	0%	Virustotal		Browse
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	0%	Virustotal		Browse
https://dev.virtualearth.net/REST/v1/Routes/Transit	0%	Virustotal		Browse
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	0%	Virustotal		Browse
https://dev.ditu.live.com/REST/v1/Locations	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	0%	Avira URL Cloud	safe
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	0%	Virustotal		Browse
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mxs.mail.ru	94.100.180.31	true	true	0%, Virustotal, Browse	unknown
mta5.am0.yahoodns.net	67.195.204.72	true	true	0%, Virustotal, Browse	unknown
jotunheim.name	80.66.75.11	true	true	14%, Virustotal, Browse	unknown
microsoft-com.mail.protection.outlook.com	52.101.11.0	true	true	0%, Virustotal, Browse	unknown
vanaheim.cn	195.133.13.231	true	true	17%, Virustotal, Browse	unknown
smtp.google.com	173.194.76.26	true	false	0%, Virustotal, Browse	unknown
google.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
time.windows.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
yahoo.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
mail.ru	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
jotunheim.name:443	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
vanaheim.cn:443	true	8%, Virustotal, Browse Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000002.00000003.1410254879.000002636625D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000002.00000002.1426870101.0000026366268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390205159.0000026366267000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000002.00000002.1426886129.0000026366270000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1385716596.000002636626E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000002.00000002.1426870101.0000026366268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390205159.0000026366267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426727211.000002636622B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000002.00000003.1392924123.0000026366262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426727211.000002636622B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000002.00000002.1426791972.0000026366244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1401912422.000002636625E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000002.00000002.1426791972.0000026366244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1392924123.0000026366262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000002.00000003.1383970177.0000026366234000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	svchost.exe, 0000000D.00000002.3693187786.000002CE7C287000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3694275058.000002CE7CB02000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.13.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000002.1426886129.0000026366270000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1414299016.000002636625A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426791972.0000026366244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1392924123.0000026366262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1415537390.0000026366243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1385716596.000002636626E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000002.00000002.1426727211.000002636622B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000002.00000002.1426775775.0000026366241000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000002.00000002.1426775775.0000026366241000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dynamic.t	svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bingmapsportal.comc	svchost.exe, 00000002.00000002.1426700791.0000026366213000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000002.00000003.1392924123.0000026366262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000002.00000003.1417561518.0000026366257000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426809926.0000026366258000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000003.1414299016.000002636625A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1392924123.0000026366262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000002.1426870101.0000026366268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1390205159.0000026366267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426727211.000002636622B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000002.00000003.1383970177.0000026366234000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1426850778.0000026366263000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
173.194.76.26	smtp.google.com	United States	15169	GOOGLEUS	false
52.101.11.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
217.69.139.150	unknown	Russian Federation	47764	MAILRU-ASMailRuRU	true
67.195.204.77	unknown	United States	26101	YAHOO-3US	true
67.195.204.72	mta5.am0.yahoodns.net	United States	26101	YAHOO-3US	true
195.133.13.231	vanaheim.cn	Russian Federation	197695	AS-REGRU	true
94.100.180.31	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
80.66.75.11	jotunheim.name	Russian Federation	20803	RISS-ASRU	true
104.47.54.36	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1468508
Start date and time:	2024-07-06 09:10:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vyrcclmm.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@34/6@14/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 66 Number of non-executed functions: 256
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 40.119.148.38, 20.76.201.171, 20.70.246.20, 20.236.44.162, 20.231.239.246, 20.112.250.133
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:21:33	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
04:21:38	API Interceptor	857x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.11.0	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse
217.69.139.150	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse
67.195.204.77	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	data.log.exe	Get hash	malicious	Unknown	Browse
	message.elm.exe	Get hash	malicious	Unknown	Browse
	message.txt.exe	Get hash	malicious	Unknown	Browse
	test.dat.exe	Get hash	malicious	Unknown	Browse
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB9504-x86.exe	Get hash	malicious	Unknown	Browse
	La60esvnOK.exe	Get hash	malicious	Raccoon SmokeLoader Tofsee Vidar Xmrig	Browse
	SecuriteInfo.com.Trojan.DownLoader41.25700.7371.exe	Get hash	malicious	Tofsee Xmrig	Browse
67.195.204.72	file.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	data.log.exe	Get hash	malicious	Unknown	Browse
	message.elm.exe	Get hash	malicious	Unknown	Browse
	message.txt.exe	Get hash	malicious	Unknown	Browse
	Update-KB7390-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB6734-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse
	file.txt.exe	Get hash	malicious	Unknown	Browse
195.133.13.231	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mxs.mail.ru	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	yq5xNPpWCT.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	94.100.180.31
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	94.100.180.31
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	217.69.139.150
microsoft-com.mail.protection.outlook.com	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	bill.txt.exe	Get hash	malicious	Unknown	Browse	104.47.54.36
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
mta5.am0.yahoodns.net	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.74
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.77
	newtpp.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.77
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	67.195.228.109
	.exe	Get hash	malicious	Unknown	Browse	67.195.228.111
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.75
jotunheim.name	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	80.66.75.11
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	SecuriteInfo.com.Win32.BotX-gen.15544.10747.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	SecuriteInfo.com.Win32.BotX-gen.28812.11191.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	SecuriteInfo.com.Trojan.Siggen23.53341.25424.13682.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAILRU-ASMailRuRU	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	http://ct31152.tw1.ru/	Get hash	malicious	Unknown	Browse	94.100.180.226
	http://cb00287.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	http://cv59800.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	https://cs13786.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	http://cf20871.tw1.ru/	Get hash	malicious	Unknown	Browse	5.61.23.11
	x64.nn.elf	Get hash	malicious	Mirai	Browse	128.140.169.91
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
YAHOO-3US	HTUyCRuDev.elf	Get hash	malicious	Unknown	Browse	98.139.142.32
	https://yellatism.com/click.php?key=2240o76mk7oyoycyr074&cid=cphbldi9sch0sh7da130&zone=2353135-2517555085-3576986712&campaign=395161020&type=Push&age=11&creative_id=547520&campaign_id=108855&site_id=11517&placement_id=43113822&preset_id=500	Get hash	malicious	Unknown	Browse	74.6.143.26
	wQsdlAeKOF.elf	Get hash	malicious	Mirai	Browse	98.139.142.16
	NA9GDRMmA3.elf	Get hash	malicious	Unknown	Browse	74.6.62.1
	V#U2550DEOS.EXE	Get hash	malicious	Brontok	Browse	74.6.143.26
	YCrL9vbZ3g.elf	Get hash	malicious	Mirai	Browse	98.139.142.20
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	https://www.canva.com/design/DAGDiia04Xg/_SQxN5BXpIl2RgDD44fATw/edit?utm_content=DAGDiia04Xg&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	98zdN8lGtk.elf	Get hash	malicious	Unknown	Browse	76.13.122.13
	https://yhs-world-aged-dust-4671.aubrey744.workers.dev/favicon.ico	Get hash	malicious	HTMLPhisher	Browse	66.218.84.137
MICROSOFT-CORP-MSN-AS-BLOCKUS	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	(No subject) (29).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.65.28
	arm5-20240706-0012.elf	Get hash	malicious	Mirai	Browse	20.18.255.130
	https://pub-fb608504b57048a1b1ca54c74dbf132d.r2.dev/ront.html?ccsend	Get hash	malicious	HTMLPhisher	Browse	20.76.252.24
	https://netorgft11417463-my.sharepoint.com/:o:/g/personal/miraxy_mlmfoodsusa_com/Ep2tW9OiVYhPtqAXFyRLSFoBWqPOojE29ja-FQWlUqv0SA?e=5%3algW4EA&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://bainbridgemfg-my.sharepoint.com/:o:/p/david/ErvlllHCJGpPobC1afGT7j4Badn5zob3qi0w_pRTIz-v-g?e=5%3a0L4XAf&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://starsof.com/404.php?7-797967704b536932307465765443334f7a4d6d73306b744f533948337a676e494439454841413d3d-amdyb3dAdG9sbGVzb25hei5vcmc=	Get hash	malicious	HTMLPhisher	Browse	13.74.129.92
	https://deacerousa2-my.sharepoint.com/:o:/g/personal/eservice_huynhlaw_com/Ekv2F9Kc_pJJuB-bxZ7Z5QcBrNuZWh85OaRkXp9nQSqCiQ?e=5%3aD7eLEH&at=9	Get hash	malicious	HTMLPhisher	Browse	52.107.242.226
	https://deacerousa2-my.sharepoint.com/:o:/g/personal/eservice_huynhlaw_com/Ekv2F9Kc_pJJuB-bxZ7Z5QcBrNuZWh85OaRkXp9nQSqCiQ?e=5%3aD7eLEH&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	Christy Towler shared _OmniSource Marketing Group_ with you.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
YAHOO-3US	HTUyCRuDev.elf	Get hash	malicious	Unknown	Browse	98.139.142.32
	https://yellatism.com/click.php?key=2240o76mk7oyoycyr074&cid=cphbldi9sch0sh7da130&zone=2353135-2517555085-3576986712&campaign=395161020&type=Push&age=11&creative_id=547520&campaign_id=108855&site_id=11517&placement_id=43113822&preset_id=500	Get hash	malicious	Unknown	Browse	74.6.143.26
	wQsdlAeKOF.elf	Get hash	malicious	Mirai	Browse	98.139.142.16
	NA9GDRMmA3.elf	Get hash	malicious	Unknown	Browse	74.6.62.1
	V#U2550DEOS.EXE	Get hash	malicious	Brontok	Browse	74.6.143.26
	YCrL9vbZ3g.elf	Get hash	malicious	Mirai	Browse	98.139.142.20
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	https://www.canva.com/design/DAGDiia04Xg/_SQxN5BXpIl2RgDD44fATw/edit?utm_content=DAGDiia04Xg&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	76.13.32.146
	98zdN8lGtk.elf	Get hash	malicious	Unknown	Browse	76.13.122.13
	https://yhs-world-aged-dust-4671.aubrey744.workers.dev/favicon.ico	Get hash	malicious	HTMLPhisher	Browse	66.218.84.137

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	1.1989171971449115
Encrypted:	false
SSDEEP:	12:OTqPqF69Fq5DQehk56GWtbgjO3s7Nxk56G5le0Thl+oad:OM1JmGtm2jGt5g8l+x
MD5:	1FC56A241333C0F0B08DA5F6FFDB2602
SHA1:	4C60784311BEDDC4AB2BDAC8529211677BB7AF69
SHA-256:	C39D4F4FCB95D49AD932028F6E01275FE3F05CB653533C02AC94325C50A37F54
SHA-512:	57C77AF412C55E4608125FC06FF155E19E4F82D243A3DD89DE230AADC3F21A6A1C3682F1ACA9FEDB3AF9ED722597B7E71BB238CDFAF766E32B89072DF741D5B1
Malicious:	false
Preview:	............................................................................D.............\.s...................eJ..............Zb..K....(......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1..............................................................?W.............\.s...........U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.S.y.s.t.e.m.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...e.3.2.3.d.a.c.c.-.2.6.4.7.-.4.c.c.d.-.8.b.7.c.-.9.7.6.c.8.7.6.a.1.a.2.b...1...e.t.l...........P.P..........f^.s...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\Users\user\AppData\Local\Temp\pspizbvl.exe

Download File

Process:	C:\Users\user\Desktop\vyrcclmm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	13180416
Entropy (8bit):	5.507441220985376
Encrypted:	false
SSDEEP:	98304:9qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq3:
MD5:	38DF4E4C47840B37306FF102DD07903D
SHA1:	6E4BD0EDFDDE08C290555F10CE45BB971A7A6E50
SHA-256:	3880E692DB7811D3DB60D7F5C66624DB46EFEA75740596A640E53BEFD740E9EF
SHA-512:	6F0E323A79068B1D334544AE3F33C12FF7E2C72CB60A1DFB1D118EF391FB631EC87AEB6554DF8F85CDB9DAA38DFD988517634F16FECA61E4FA1DFEFF9FC8A362
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............yB.yB.yB...B.yB...B.yB...B..yB...B.yB.xB..yB...B.yB...B.yB...B.yBRich.yB................PE..L...577d.....................P@.....h%............@...........................B......;......................................<9.......PA..............................9...............................4..@............................................text...p........................... ..`.rdata..d2.......4..................@..@.data.....>..P.......6..............@....rsrc........PA..4..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.2488343793843195
Encrypted:	false
SSDEEP:	24:QOaqdmuF3rGY+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPVx+:FaqdF7j+AAHdKoqKFxcxkFj
MD5:	44910CACB1F6C7DB5B7DC2B4A8C0DE89
SHA1:	F179B8C8F8424E44DD081F237092C4D5D1D4EDD4
SHA-256:	A9AC501DD0CD08D830D2B2097073A3BB942523826000FD080DB7D5C96421F3A9
SHA-512:	DDFC14D4B35A5130F49263F730D008BAA28DCEF8EF9EB2CF68AA9F019F441D01419C95C7F7D23D6A4764B7E4995716F0F52345810D80E70FED4B5E8B91F8BC4C
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. S.a.t. .. J.u.l. .. 0.6. .. 2.0.2.4. .0.4.:.2.1.:.3.3.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13180416
Entropy (8bit):	5.507441220985376
Encrypted:	false
SSDEEP:	98304:9qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq3:
MD5:	38DF4E4C47840B37306FF102DD07903D
SHA1:	6E4BD0EDFDDE08C290555F10CE45BB971A7A6E50
SHA-256:	3880E692DB7811D3DB60D7F5C66624DB46EFEA75740596A640E53BEFD740E9EF
SHA-512:	6F0E323A79068B1D334544AE3F33C12FF7E2C72CB60A1DFB1D118EF391FB631EC87AEB6554DF8F85CDB9DAA38DFD988517634F16FECA61E4FA1DFEFF9FC8A362
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............yB.yB.yB...B.yB...B.yB...B..yB...B.yB.xB..yB...B.yB...B.yB...B.yBRich.yB................PE..L...577d.....................P@.....h%............@...........................B......;......................................<9.......PA..............................9...............................4..@............................................text...p........................... ..`.rdata..d2.......4..................@..@.data.....>..P.......6..............@....rsrc........PA..4..................@..@........................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.513171290077752
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vyrcclmm.exe
File size:	10'890'752 bytes
MD5:	52d6521fdf86ef42b47afa05bf06225f
SHA1:	ffe1dca080b60cac20e6d2dcba807388badde68f
SHA256:	039bcb175a6042892395691ef543d82135ff3e0542cc18a30b791d20d205b966
SHA512:	9d70674d23ad82d1210b7cfd755f7aa5a590883bcddbb18a54e5a53706b642d606c0244c3d9b97ee93615d80d72a51e9e69241a48bd98a222a757244551a350a
SSDEEP:	98304:Gqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqv:
TLSH:	3DB67C90E7E25880F66B493B8A617ED4D57FFC52FBE2D27F22045A2F2C71652C502326
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............yB..yB..yB...B..yB...B..yB...B..yB...B..yB..xB..yB...B..yB...B..yB...B..yBRich..yB................PE..L...577d...........

File Icon


Icon Hash:	63796de961636e0f

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2024 09:11:32.674210072 CEST	49705	25	192.168.2.7	52.101.11.0
Jul 6, 2024 09:11:33.663700104 CEST	49705	25	192.168.2.7	52.101.11.0
Jul 6, 2024 09:11:35.539781094 CEST	49706	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:11:35.539833069 CEST	443	49706	195.133.13.231	192.168.2.7
Jul 6, 2024 09:11:35.539908886 CEST	49706	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:11:35.757577896 CEST	49705	25	192.168.2.7	52.101.11.0
Jul 6, 2024 09:11:39.851382017 CEST	49705	25	192.168.2.7	52.101.11.0
Jul 6, 2024 09:11:47.866978884 CEST	49705	25	192.168.2.7	52.101.11.0
Jul 6, 2024 09:11:52.684009075 CEST	49707	25	192.168.2.7	67.195.204.72
Jul 6, 2024 09:11:53.867024899 CEST	49707	25	192.168.2.7	67.195.204.72
Jul 6, 2024 09:11:55.882550001 CEST	49707	25	192.168.2.7	67.195.204.72
Jul 6, 2024 09:11:59.882570028 CEST	49707	25	192.168.2.7	67.195.204.72
Jul 6, 2024 09:12:07.882570982 CEST	49707	25	192.168.2.7	67.195.204.72
Jul 6, 2024 09:12:12.717941046 CEST	49708	25	192.168.2.7	173.194.76.26
Jul 6, 2024 09:12:13.726485968 CEST	49708	25	192.168.2.7	173.194.76.26
Jul 6, 2024 09:12:15.539021969 CEST	49706	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:12:15.539108038 CEST	443	49706	195.133.13.231	192.168.2.7
Jul 6, 2024 09:12:15.539222002 CEST	49706	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:12:15.649183989 CEST	49709	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:12:15.649228096 CEST	443	49709	195.133.13.231	192.168.2.7
Jul 6, 2024 09:12:15.649317980 CEST	49709	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:12:15.726361990 CEST	49708	25	192.168.2.7	173.194.76.26
Jul 6, 2024 09:12:19.742044926 CEST	49708	25	192.168.2.7	173.194.76.26
Jul 6, 2024 09:12:27.757787943 CEST	49708	25	192.168.2.7	173.194.76.26
Jul 6, 2024 09:12:32.730051994 CEST	49713	25	192.168.2.7	94.100.180.31
Jul 6, 2024 09:12:33.726478100 CEST	49713	25	192.168.2.7	94.100.180.31
Jul 6, 2024 09:12:35.742069960 CEST	49713	25	192.168.2.7	94.100.180.31
Jul 6, 2024 09:12:39.898339987 CEST	49713	25	192.168.2.7	94.100.180.31
Jul 6, 2024 09:12:47.898432016 CEST	49713	25	192.168.2.7	94.100.180.31
Jul 6, 2024 09:12:55.648493052 CEST	49709	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:12:55.648583889 CEST	443	49709	195.133.13.231	192.168.2.7
Jul 6, 2024 09:12:55.648665905 CEST	49709	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:12:55.759254932 CEST	49714	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:12:55.759309053 CEST	443	49714	195.133.13.231	192.168.2.7
Jul 6, 2024 09:12:55.759408951 CEST	49714	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:13:35.757987022 CEST	49714	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:13:35.758055925 CEST	443	49714	195.133.13.231	192.168.2.7
Jul 6, 2024 09:13:35.758224964 CEST	49714	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:13:35.868088007 CEST	49715	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:13:35.868168116 CEST	443	49715	195.133.13.231	192.168.2.7
Jul 6, 2024 09:13:35.868266106 CEST	49715	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:13:59.377273083 CEST	49717	25	192.168.2.7	104.47.54.36
Jul 6, 2024 09:14:00.382986069 CEST	49717	25	192.168.2.7	104.47.54.36
Jul 6, 2024 09:14:02.445547104 CEST	49717	25	192.168.2.7	104.47.54.36
Jul 6, 2024 09:14:06.445566893 CEST	49717	25	192.168.2.7	104.47.54.36
Jul 6, 2024 09:14:14.539278030 CEST	49717	25	192.168.2.7	104.47.54.36
Jul 6, 2024 09:14:15.867582083 CEST	49715	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:14:15.867645025 CEST	443	49715	195.133.13.231	192.168.2.7
Jul 6, 2024 09:14:15.867753029 CEST	49715	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:14:15.978482008 CEST	49718	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:14:15.978538990 CEST	443	49718	195.133.13.231	192.168.2.7
Jul 6, 2024 09:14:15.978634119 CEST	49718	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:14:19.377983093 CEST	49719	25	192.168.2.7	67.195.204.77
Jul 6, 2024 09:14:20.383140087 CEST	49719	25	192.168.2.7	67.195.204.77
Jul 6, 2024 09:14:22.383124113 CEST	49719	25	192.168.2.7	67.195.204.77
Jul 6, 2024 09:14:26.383114100 CEST	49719	25	192.168.2.7	67.195.204.77
Jul 6, 2024 09:14:34.398843050 CEST	49719	25	192.168.2.7	67.195.204.77
Jul 6, 2024 09:14:39.392369032 CEST	49720	25	192.168.2.7	173.194.76.26
Jul 6, 2024 09:14:40.383187056 CEST	49720	25	192.168.2.7	173.194.76.26
Jul 6, 2024 09:14:42.383186102 CEST	49720	25	192.168.2.7	173.194.76.26
Jul 6, 2024 09:14:46.383219004 CEST	49720	25	192.168.2.7	173.194.76.26
Jul 6, 2024 09:14:54.398869038 CEST	49720	25	192.168.2.7	173.194.76.26
Jul 6, 2024 09:14:55.977133989 CEST	49718	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:14:55.977220058 CEST	443	49718	195.133.13.231	192.168.2.7
Jul 6, 2024 09:14:55.977308035 CEST	49718	443	192.168.2.7	195.133.13.231
Jul 6, 2024 09:14:56.098345995 CEST	49721	443	192.168.2.7	80.66.75.11
Jul 6, 2024 09:14:56.098395109 CEST	443	49721	80.66.75.11	192.168.2.7
Jul 6, 2024 09:14:56.098629951 CEST	49721	443	192.168.2.7	80.66.75.11
Jul 6, 2024 09:14:59.393008947 CEST	49722	25	192.168.2.7	217.69.139.150
Jul 6, 2024 09:15:00.398951054 CEST	49722	25	192.168.2.7	217.69.139.150
Jul 6, 2024 09:15:02.398817062 CEST	49722	25	192.168.2.7	217.69.139.150
Jul 6, 2024 09:15:06.414453983 CEST	49722	25	192.168.2.7	217.69.139.150

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2024 09:11:11.773183107 CEST	61641	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:11:32.647283077 CEST	65167	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:11:32.673497915 CEST	53	65167	1.1.1.1	192.168.2.7
Jul 6, 2024 09:11:35.491096973 CEST	63042	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:11:35.502367020 CEST	53	63042	1.1.1.1	192.168.2.7
Jul 6, 2024 09:11:52.664469957 CEST	56284	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:11:52.673046112 CEST	53	56284	1.1.1.1	192.168.2.7
Jul 6, 2024 09:11:52.673818111 CEST	52309	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:11:52.683382988 CEST	53	52309	1.1.1.1	192.168.2.7
Jul 6, 2024 09:12:12.695873976 CEST	54450	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:12:12.704437971 CEST	53	54450	1.1.1.1	192.168.2.7
Jul 6, 2024 09:12:12.706026077 CEST	60681	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:12:12.714915991 CEST	53	60681	1.1.1.1	192.168.2.7
Jul 6, 2024 09:12:32.712018013 CEST	53416	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:12:32.719425917 CEST	53	53416	1.1.1.1	192.168.2.7
Jul 6, 2024 09:12:32.720911026 CEST	59281	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:12:32.728657007 CEST	53	59281	1.1.1.1	192.168.2.7
Jul 6, 2024 09:13:59.341948032 CEST	65068	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:13:59.376648903 CEST	53	65068	1.1.1.1	192.168.2.7
Jul 6, 2024 09:14:19.368593931 CEST	49386	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:14:19.377379894 CEST	53	49386	1.1.1.1	192.168.2.7
Jul 6, 2024 09:14:39.383851051 CEST	59236	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:14:39.391499996 CEST	53	59236	1.1.1.1	192.168.2.7
Jul 6, 2024 09:14:56.086985111 CEST	57764	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:14:56.097516060 CEST	53	57764	1.1.1.1	192.168.2.7
Jul 6, 2024 09:14:59.384335995 CEST	60869	53	192.168.2.7	1.1.1.1
Jul 6, 2024 09:14:59.392393112 CEST	53	60869	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 6, 2024 09:11:11.773183107 CEST	192.168.2.7	1.1.1.1	0x618d	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:32.647283077 CEST	192.168.2.7	1.1.1.1	0xe732	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:35.491096973 CEST	192.168.2.7	1.1.1.1	0x43da	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:52.664469957 CEST	192.168.2.7	1.1.1.1	0x3549	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:11:52.673818111 CEST	192.168.2.7	1.1.1.1	0xb834	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:12:12.695873976 CEST	192.168.2.7	1.1.1.1	0x9b62	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:12:12.706026077 CEST	192.168.2.7	1.1.1.1	0xa52e	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:12:32.712018013 CEST	192.168.2.7	1.1.1.1	0xb579	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:12:32.720911026 CEST	192.168.2.7	1.1.1.1	0xa65c	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:13:59.341948032 CEST	192.168.2.7	1.1.1.1	0xfd45	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:19.368593931 CEST	192.168.2.7	1.1.1.1	0x8f35	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:39.383851051 CEST	192.168.2.7	1.1.1.1	0xad14	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:14:56.086985111 CEST	192.168.2.7	1.1.1.1	0xac98	Standard query (0)	jotunheim.name	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:59.384335995 CEST	192.168.2.7	1.1.1.1	0x5685	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 6, 2024 09:11:11.780968904 CEST	1.1.1.1	192.168.2.7	0x618d	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 6, 2024 09:11:32.673497915 CEST	1.1.1.1	192.168.2.7	0xe732	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.11.0	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:32.673497915 CEST	1.1.1.1	192.168.2.7	0xe732	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.8.49	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:32.673497915 CEST	1.1.1.1	192.168.2.7	0xe732	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.42.0	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:32.673497915 CEST	1.1.1.1	192.168.2.7	0xe732	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.40.26	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:35.502367020 CEST	1.1.1.1	192.168.2.7	0x43da	No error (0)	vanaheim.cn		195.133.13.231	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:52.673046112 CEST	1.1.1.1	192.168.2.7	0x3549	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:11:52.673046112 CEST	1.1.1.1	192.168.2.7	0x3549	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:11:52.673046112 CEST	1.1.1.1	192.168.2.7	0x3549	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:11:52.683382988 CEST	1.1.1.1	192.168.2.7	0xb834	No error (0)	mta5.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:52.683382988 CEST	1.1.1.1	192.168.2.7	0xb834	No error (0)	mta5.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:52.683382988 CEST	1.1.1.1	192.168.2.7	0xb834	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:52.683382988 CEST	1.1.1.1	192.168.2.7	0xb834	No error (0)	mta5.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:52.683382988 CEST	1.1.1.1	192.168.2.7	0xb834	No error (0)	mta5.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:52.683382988 CEST	1.1.1.1	192.168.2.7	0xb834	No error (0)	mta5.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:52.683382988 CEST	1.1.1.1	192.168.2.7	0xb834	No error (0)	mta5.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:11:52.683382988 CEST	1.1.1.1	192.168.2.7	0xb834	No error (0)	mta5.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:12:12.704437971 CEST	1.1.1.1	192.168.2.7	0x9b62	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:12:12.714915991 CEST	1.1.1.1	192.168.2.7	0xa52e	No error (0)	smtp.google.com		173.194.76.26	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:12:12.714915991 CEST	1.1.1.1	192.168.2.7	0xa52e	No error (0)	smtp.google.com		108.177.15.26	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:12:12.714915991 CEST	1.1.1.1	192.168.2.7	0xa52e	No error (0)	smtp.google.com		66.102.1.26	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:12:12.714915991 CEST	1.1.1.1	192.168.2.7	0xa52e	No error (0)	smtp.google.com		173.194.76.27	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:12:12.714915991 CEST	1.1.1.1	192.168.2.7	0xa52e	No error (0)	smtp.google.com		66.102.1.27	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:12:32.719425917 CEST	1.1.1.1	192.168.2.7	0xb579	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:12:32.728657007 CEST	1.1.1.1	192.168.2.7	0xa65c	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:12:32.728657007 CEST	1.1.1.1	192.168.2.7	0xa65c	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:13:59.376648903 CEST	1.1.1.1	192.168.2.7	0xfd45	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:13:59.376648903 CEST	1.1.1.1	192.168.2.7	0xfd45	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:19.377379894 CEST	1.1.1.1	192.168.2.7	0x8f35	No error (0)	mta5.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:19.377379894 CEST	1.1.1.1	192.168.2.7	0x8f35	No error (0)	mta5.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:19.377379894 CEST	1.1.1.1	192.168.2.7	0x8f35	No error (0)	mta5.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:19.377379894 CEST	1.1.1.1	192.168.2.7	0x8f35	No error (0)	mta5.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:19.377379894 CEST	1.1.1.1	192.168.2.7	0x8f35	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:19.377379894 CEST	1.1.1.1	192.168.2.7	0x8f35	No error (0)	mta5.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:19.377379894 CEST	1.1.1.1	192.168.2.7	0x8f35	No error (0)	mta5.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:19.377379894 CEST	1.1.1.1	192.168.2.7	0x8f35	No error (0)	mta5.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:39.391499996 CEST	1.1.1.1	192.168.2.7	0xad14	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
Jul 6, 2024 09:14:56.097516060 CEST	1.1.1.1	192.168.2.7	0xac98	No error (0)	jotunheim.name		80.66.75.11	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:59.392393112 CEST	1.1.1.1	192.168.2.7	0x5685	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Jul 6, 2024 09:14:59.392393112 CEST	1.1.1.1	192.168.2.7	0x5685	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:11:01
Start date:	06/07/2024
Path:	C:\Users\user\Desktop\vyrcclmm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\vyrcclmm.exe"
Imagebase:	0x400000
File size:	10'890'752 bytes
MD5 hash:	52D6521FDF86EF42B47AFA05BF06225F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.1257457512.0000000004460000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.3694703474.00000000028E2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:11:06
Start date:	06/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:11:06
Start date:	06/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:11:06
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bzycpcet\
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:11:06
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:11:06
Start date:	06/07/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7161e0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:11:07
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\bzycpcet\
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:11:07
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:11:07
Start date:	06/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:11:07
Start date:	06/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:11:07
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create bzycpcet binPath= "C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d\"C:\Users\user\Desktop\vyrcclmm.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xa40000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:11:07
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:11:07
Start date:	06/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	03:11:08
Start date:	06/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:11:08
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description bzycpcet "wifi internet conection"
Imagebase:	0xa40000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:11:08
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:11:09
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start bzycpcet
Imagebase:	0xa40000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:11:09
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:11:09
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe /d"C:\Users\user\Desktop\vyrcclmm.exe"
Imagebase:	0x400000
File size:	13'180'416 bytes
MD5 hash:	38DF4E4C47840B37306FF102DD07903D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000014.00000003.1384034173.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000014.00000002.1689340348.0000000003130000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000014.00000002.1689220789.00000000029ED000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:11:09
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1770000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:11:10
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:11:10
Start date:	06/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	03:11:18
Start date:	06/07/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x890000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	04:21:11
Start date:	06/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	04:21:33
Start date:	06/07/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff6a5ca0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:21:33
Start date:	06/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	24.8%
Total number of Nodes:	1539
Total number of Limit Nodes:	19

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 0040A078
\, xrefs: 00409D0C
", xrefs: 0040A189
", xrefs: 00409EDB
D, xrefs: 00409F8E
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
P, xrefs: 00409DAA
%X%08X, xrefs: 0040A0B0

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 408deff44febd3916874fa53db5e5f0dd1b788e316581794cedda39bc3a0aab8
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 408deff44febd3916874fa53db5e5f0dd1b788e316581794cedda39bc3a0aab8
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: fb32ede88c892ccab39cf83d003fcbea33a4e2e8563a4575a47fd59e5a1c2ade
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: fb32ede88c892ccab39cf83d003fcbea33a4e2e8563a4575a47fd59e5a1c2ade
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,771A8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 4febc6132cbb2eeae90f99f22907b6d3a51082cd0e0b87a57774915eab482f02
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 4febc6132cbb2eeae90f99f22907b6d3a51082cd0e0b87a57774915eab482f02
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 028E6DBC Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 028E6DE4
Module32First.KERNEL32(00000000,00000224), ref: 028E6E04

Memory Dump Source

Source File: 00000000.00000002.3694703474.00000000028E2000.00000040.00000020.00020000.00000000.sdmp, Offset: 028E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28e2000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c2c9c6b2fe92bf2741dc21397852692fb31cf94e2c46c9b0eae69dd74a3d63bd
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 07F0623D6007256BDB203AB9988DB6F76ECAF5A624F500568E647D10C0EB71F8454A61

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,771B0F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,771B0F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,771B0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,771B0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,771B0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,771B0F10,?,771B0F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(771B0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,771B0F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(771B0F10,?,771B0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(771B0F10), ref: 00407208
RegCloseKey.ADVAPI32(771B0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(771B0F10), ref: 004072D0
RegCloseKey.ADVAPI32(771B0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(771B0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
, xrefs: 00407194
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 618cfb6f1b26c540220dcc2678a44076c62346fd56d5638b59146fa8fa35b1d5
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 618cfb6f1b26c540220dcc2678a44076c62346fd56d5638b59146fa8fa35b1d5
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,771B0F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,771B0F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,771B0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,771B0F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,771B0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: e164254f3378dd396073a59d5f8bf438da5901e9f91fe2d8a4805c76184d12e6
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: e164254f3378dd396073a59d5f8bf438da5901e9f91fe2d8a4805c76184d12e6
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 029C003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 029C024D

Strings

cess, xrefs: 029C018D
kernel32.dll, xrefs: 029C008F, 029C0095

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: efaa1d7d26af55e79ec8504546794ef3e715198f52718c2fe88bf1d14a41d913
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: D5526974A01229DFDB64CF58C984BACBBB5BF09304F1480E9E94DAB351DB30AA95CF15

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,771A8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: addf51b803be8b3fdc0b349711ac0ded489e61cd96ba8191abdedb398079e53a
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: addf51b803be8b3fdc0b349711ac0ded489e61cd96ba8191abdedb398079e53a
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 0dc9418032d7fae7e99f7ff6decd2e171138db246ccd5078cf7f6b69033b9994
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 0dc9418032d7fae7e99f7ff6decd2e171138db246ccd5078cf7f6b69033b9994
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 029C0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,029C0223,?,?), ref: 029C0E19
SetErrorMode.KERNELBASE(00000000,?,?,029C0223,?,?), ref: 029C0E1E

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 009e48eb130ead0992d2560500b46c4144bfb721bf901a4af9774b3f20ef8929
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 5DD01231145128B7D7003A94DC09BCD7B1CDF05B66F108011FB0DD9081C770954046E6

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 028E6A7B Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 028E6ACC

Memory Dump Source

Source File: 00000000.00000002.3694703474.00000000028E2000.00000040.00000020.00020000.00000000.sdmp, Offset: 028E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28e2000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9620e6d9832911e87f0f134c0f63f6ad43d6d99cf64f6947643a62a8a8e92e7a
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 72113C79A00208EFDB01DF98C985E98BFF5AF09351F058094F949AB361D371EA50DF80

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1394filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

drivers\, xrefs: 0040D067
local_time, xrefs: 0040CACD
wtm_w, xrefs: 0040C96C
wtm_c, xrefs: 0040C956
lid_file_upd, xrefs: 0040CE6A
4, xrefs: 0040D9F7
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
srv_time, xrefs: 0040CABB
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
.sys, xrefs: 0040D0CC
wtm_r, xrefs: 0040C97F
@, xrefs: 0040D754
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
flags_upd, xrefs: 0040CE4A
\, xrefs: 0040D39D
\, xrefs: 0040D3A7
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 58c16bf96f04c64393462683c7350eaf522ff62be46463dd462b2a21f2a14f1c
Instruction ID: e3e311afffee0f8fdcefab3b6ad12dcdc3eb324b3d868ccf40e5e7320ccd552c
Opcode Fuzzy Hash: 58c16bf96f04c64393462683c7350eaf522ff62be46463dd462b2a21f2a14f1c
Instruction Fuzzy Hash: BDB2C471D00209BBEB209FA4DD85FEA7BB9AB08304F14457BF505B22D1D7789A89CB5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlInitUnicodeString, xrefs: 00401135
RtlNtStatusToDosError, xrefs: 00401194
RtlSetLastWin32Error, xrefs: 004010D6
NtSetInformationThread, xrefs: 00401155
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtQueryInformationToken, xrefs: 00401262
NtDuplicateToken, xrefs: 004011F3
RtlFreeSid, xrefs: 00401116
NtTerminateProcess, xrefs: 004010F6
NtSetInformationToken, xrefs: 00401175
RtlLengthSid, xrefs: 00401246
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtOpenProcessToken, xrefs: 004011D4
NtFilterToken, xrefs: 0040122B
ntdll.dll, xrefs: 0040100D
NtClose, xrefs: 004011B4

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: def56848a29238af3b3263ec016d123599b8ce3514d2c8bce6aae186bf62253e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: def56848a29238af3b3263ec016d123599b8ce3514d2c8bce6aae186bf62253e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Jun, xrefs: 0040B279
Jan, xrefs: 0040B256
Mon, xrefs: 0040B22C
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Aug, xrefs: 0040B287
Apr, xrefs: 0040B26B
Fri, xrefs: 0040B248
Feb, xrefs: 0040B25D
Tue, xrefs: 0040B233
May, xrefs: 0040B272
Nov, xrefs: 0040B29C
Thu, xrefs: 0040B241
Sun, xrefs: 0040B225
Dec, xrefs: 0040B2A3
Mar, xrefs: 0040B264
Wed, xrefs: 0040B23A
Oct, xrefs: 0040B295
Sep, xrefs: 0040B28E
Jul, xrefs: 0040B280
Sat, xrefs: 0040B24F

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 9c254f7c2f4551e4858b08560ebcfb375181b6b247abdacfd65a4178375c92cf
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: 9c254f7c2f4551e4858b08560ebcfb375181b6b247abdacfd65a4178375c92cf
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 93d2068cc19732fe8ad9ae0a9f51e86421eb0c8fa32be1230cd8688bd4bd79d5
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: 93d2068cc19732fe8ad9ae0a9f51e86421eb0c8fa32be1230cd8688bd4bd79d5
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

useless, xrefs: 0040161E
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
uac, xrefs: 00401628
D, xrefs: 004015C6
wusa.exe, xrefs: 00401388
<, xrefs: 00401378
, xrefs: 00401462

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 4a22ad167bc3991e7243980079933dba70382744969d1905516b1f864c22465e
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 4a22ad167bc3991e7243980079933dba70382744969d1905516b1f864c22465e
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

born_date, xrefs: 00401EAD, 00401ECC
loader_id, xrefs: 00401F4B, 00401F6B
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
lid_file_upd, xrefs: 00401E25
kernel32, xrefs: 00401DF7
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
start_srv, xrefs: 00401E6C
work_srv, xrefs: 00401E5E
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
net_type, xrefs: 00401E87
IsWow64Process, xrefs: 00401DF2

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,771AF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,771AF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 5dd434fdf3d1b2f7ac71eae5deaa1b81d7ffa9032da077e8e99a06cc7be058a2
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: 5dd434fdf3d1b2f7ac71eae5deaa1b81d7ffa9032da077e8e99a06cc7be058a2
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: ee9ff6285cd0759b386b71dc2009f55f092fb3ff13d227db5bcc73c144141d81
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: ee9ff6285cd0759b386b71dc2009f55f092fb3ff13d227db5bcc73c144141d81
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 029C65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 029C65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 029C6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 029C6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 029C6652

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 9192f060f6a62aafe21a7a5296de299d7fd381c1f8a415300dc4090e7f874b1f
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 92117771600218BFDB119F65DD49F9B3FACEB457A5F204029FA04D7250D7B1DD00CAA5

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 7316c1f4b5cb1443490bb148765e0df43b8208094f0d347aba08efc86f487165
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 7316c1f4b5cb1443490bb148765e0df43b8208094f0d347aba08efc86f487165
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 029C092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 029C0966
., xrefs: 029C095F
GetProcAddress., xrefs: 029C09DC, 029C09DF, 029C09E4

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 7a47b97b5e64dbf48010a1d9dc5b22c0d457724c2e04feebab4f7bc212d34119
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 9F3148B6900609DFEB10CF99C880BAEBBF9FF48324F24404AD441A7310D771EA45CBA5

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 028E6699 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3694703474.00000000028E2000.00000040.00000020.00020000.00000000.sdmp, Offset: 028E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28e2000_vyrcclmm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: bc5788c29358339c19985297edcd16430e39049177e056ba862e48b32619e435
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: A411C2BA340110AFDB50CF55DC81EA273EEEB9A324B198165ED09CB312E775E801C760

Function 029C0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: a0384b15779899da731877abe0586fec8d2dc5f538297ece355bcc05251b702a
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0301A776610704CFDF21CF24C844BAA33E9EF85215F5544A9D5069B281E774A9418B91

Function 029C9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 029C9E6D
lstrcpy.KERNEL32(?,00000000), ref: 029C9FE1
lstrcat.KERNEL32(?,?), ref: 029C9FF2
lstrcat.KERNEL32(?,0041070C), ref: 029CA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 029CA054
DeleteFileA.KERNEL32(?), ref: 029CA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 029CA0D6
lstrcpy.KERNEL32 ref: 029CA12F
lstrlen.KERNEL32(00000022), ref: 029CA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 029C9F13

Part of subcall function 029C7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 029C7081

Part of subcall function 029C6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\fdcgtgix,029C7043), ref: 029C6F4E
Part of subcall function 029C6F30: GetProcAddress.KERNEL32(00000000), ref: 029C6F55
Part of subcall function 029C6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 029C6F7B
Part of subcall function 029C6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 029C6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 029CA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 029CA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 029CA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 029CA21B
GetDriveTypeA.KERNEL32(?), ref: 029CA265
lstrcat.KERNEL32(?,00000000), ref: 029CA29F
lstrcat.KERNEL32(?,00410A34), ref: 029CA2C5
lstrcat.KERNEL32(?,00000022), ref: 029CA2D9
lstrcat.KERNEL32(?,00410A34), ref: 029CA2F4
wsprintfA.USER32 ref: 029CA31D
lstrcat.KERNEL32(?,00000000), ref: 029CA345
lstrcat.KERNEL32(?,?), ref: 029CA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 029CA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 029CA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 029CA1D1

Part of subcall function 029C9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 029C999D
Part of subcall function 029C9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 029C99BD
Part of subcall function 029C9966: RegCloseKey.ADVAPI32(?), ref: 029C99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 029CA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 029CA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 029CA41D

Strings

\, xrefs: 029C9F73
", xrefs: 029CA3F0
P, xrefs: 029CA011
", xrefs: 029CA2DF
", xrefs: 029CA142
D, xrefs: 029CA1F5

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 80b2359da728af6a6a845c81fc5e8f7303b7b7c2b4f54b8be065115ac32d2944
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 6BF140B1D4025DAFDF11DFA08C48FEF7BBDAB09304F2444AAE605E2141E7758A848F66

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: eb1a08a2c71bfc4e71cb34ece599553e47f8ddafd4bc37f5bbc1e22e926e6740
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: eb1a08a2c71bfc4e71cb34ece599553e47f8ddafd4bc37f5bbc1e22e926e6740
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 029C7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 029C7D21
GetUserNameA.ADVAPI32(?,?), ref: 029C7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029C7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 029C7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 029C7DC0
EqualSid.ADVAPI32(?,?), ref: 029C7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 029C7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029C7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 029C7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 029C7E12
LocalFree.KERNEL32(00000000), ref: 029C7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 029C7E35

Strings

D, xrefs: 029C7D73
PromptOnSecureDesktop, xrefs: 029C7FA0

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 43b702ea4071be57236086f9d746f9114e81e30f0633ff9578fb234f901e0cd8
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 8BA15CB2900219AFDF21CFA0DD88FEEBBBDFB08344F148169E505E6150D7758A85CB65

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

Jan 13 2018, xrefs: 0040653A
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
except_info, xrefs: 00406728
va=%08X%08X uef=%p, xrefs: 00406595
localcfg, xrefs: 0040672D
%d=%p, xrefs: 004066F9
plgs:, xrefs: 004066AA
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
12:08:32, xrefs: 00406535

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 61f8b68dd9f344f506cfc8e29852887e470a3443c6047e34725b67e0d060e89d
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: 61f8b68dd9f344f506cfc8e29852887e470a3443c6047e34725b67e0d060e89d
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

rcpt to:<%s>, xrefs: 0040A855
quit, xrefs: 0040A86C
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
AUTH LOGIN, xrefs: 0040A80C
ehlo %s, xrefs: 0040A7F5
mail from:<%s>, xrefs: 0040A848
data, xrefs: 0040A85E
Too small respons, xrefs: 0040A9C9
Too big smtp respons (%d bytes), xrefs: 0040A9B1
Incorrect respons, xrefs: 0040AB39
helo %s, xrefs: 0040A803
ESMTP, xrefs: 0040AA38
., xrefs: 0040A8CA
localcfg, xrefs: 0040AB0B

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ae3e940a4bde8c590484db18a6dae5c4a8b1995a6f5a2f6c6eb5761f3b661a67
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ae3e940a4bde8c590484db18a6dae5c4a8b1995a6f5a2f6c6eb5761f3b661a67
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 029C7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 029C7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029C7ACD
GetLengthSid.ADVAPI32(?), ref: 029C7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 029C7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 029C7B1F
EqualSid.ADVAPI32(?,?), ref: 029C7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 029C7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029C7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 029C7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 029C7B77
LocalFree.KERNEL32(00000000), ref: 029C7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 029C7B9A
GetAce.ADVAPI32(?,?,?), ref: 029C7BCA
EqualSid.ADVAPI32(?,?), ref: 029C7BF1
DeleteAce.ADVAPI32(?,?), ref: 029C7C0A
EqualSid.ADVAPI32(?,?), ref: 029C7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 029C7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029C7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 029C7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 029C7CE0
LocalFree.KERNEL32(00000000), ref: 029C7CEE

Strings

D, xrefs: 029C7AC3

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 32385409833fa30625b73ad9d661f335a1bc22703a3a277feb5036ee7e11f233
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 7D815C7194021AAFEB21CFE4DD84FEEBBBCAF08344F14806AE515E6250D7758A41CFA5

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: 96b744c21c97554fe267b79c97f5d976ed6b4de3d9a18d44cb0f3305665f7017
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 96b744c21c97554fe267b79c97f5d976ed6b4de3d9a18d44cb0f3305665f7017
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7
localcfg, xrefs: 004019A3
GetIfEntry, xrefs: 004019E4
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: c2d043fcc5cbb47ed0bea78f2b79b5e209498882ff798d96aae41c0d31e4dbc2
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: c2d043fcc5cbb47ed0bea78f2b79b5e209498882ff798d96aae41c0d31e4dbc2
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 029C858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 029C865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 029C867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 029C86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 029C86B1

Strings

", xrefs: 029C896C
PromptOnSecureDesktop, xrefs: 029C85B6, 029C8645, 029C86BD, 029C8708, 029C87C5, 029C8812, 029C88E9, 029C8905

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: b2dae8da84ce2fcc169ee3b69ef56760e489780a2a1faca55faddddd0aeb5018
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: BFC181B1900149BEEB12EBA4DD84EEF7BBDFB48304F24407EF605E6050E7714A948B66

Function 029C14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 029C1601
lstrlenW.KERNEL32(-00000003), ref: 029C17D8

Strings

@, xrefs: 029C15E7
<, xrefs: 029C15DF
, xrefs: 029C16C9
D, xrefs: 029C182D

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 4d8ef404f3b3d8cafdc88869f0321901fc3923cf4eb726cf09e044a40ba9cb53
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 9FF1AFB11083419FD720CF64D888BABB7E9FB88304F20892DF59A97291D7B4D944CB5B

Function 029C7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 029C76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 029C7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 029C778F
___ascii_stricmp.LIBCMT ref: 029C78B4
RegCloseKey.ADVAPI32(?), ref: 029C794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 029C796D
RegCloseKey.ADVAPI32(?), ref: 029C797E
RegCloseKey.ADVAPI32(?), ref: 029C79AC
RegCloseKey.ADVAPI32(?), ref: 029C7A56

Part of subcall function 029CF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,029C772A,?), ref: 029CF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 029C79F6
RegCloseKey.ADVAPI32(?), ref: 029C7A4D

Strings

", xrefs: 029C7800
PromptOnSecureDesktop, xrefs: 029C76C5, 029C76CA, 029C76E5, 029C7782, 029C77E6, 029C7862, 029C787B, 029C79C2

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: dc2c0da8f9d0c1cccc57cab08f3376f9e6bc54e3ffc9ec2cacb18f740d1fa0eb
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 33C17471900109AFDB11DBA4DC44FEEBBBEEF49710F3440AAE545E6190EB719A84CF62

Function 029C2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 029C2CED
socket.WS2_32(00000002,00000002,00000011), ref: 029C2D07
htons.WS2_32(00000000), ref: 029C2D42
select.WS2_32 ref: 029C2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 029C2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 029C2E62

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: b753a85bf31eb53a500745dfd22672427db77dfcfb5ad980b733062140b5a082
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 0361CFB1904309ABD3209F64DC08B6BBBE8EB88755F25482DFD84A7150D7B5D880CBA7

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_HST, xrefs: 0040AEC5
127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%s%d, xrefs: 0040AE58
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 5cd659d1eb2281404cf1ff7fe35be06c0bda1c6b56bcdef19fd154bc71bc5665
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: 5cd659d1eb2281404cf1ff7fe35be06c0bda1c6b56bcdef19fd154bc71bc5665
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,771B23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: d8108df1af11397a5f9eb0cb94d23b6045a7de0830802216e32b8eab0121211e
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: d8108df1af11397a5f9eb0cb94d23b6045a7de0830802216e32b8eab0121211e
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 029C958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 029C95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 029C95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 029C95DC
wsprintfA.USER32 ref: 029C9635
wsprintfA.USER32 ref: 029C9673
wsprintfA.USER32 ref: 029C96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 029C9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 029C978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 029C97D8

Strings

PromptOnSecureDesktop, xrefs: 029C9604, 029C9624, 029C9662, 029C9683, 029C96B6, 029C96DF, 029C9701, 029C9734, 029C9780, 029C97B7

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: e77bcdcfa7b5a603a514a67604050b02472de1562d3dea4cd432d72740f381a5
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 7AA16FB1900248EFFB21DFA0CC85FEA3BADEB44745F20402AFA1596151E775D684CFA6

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62
06A, xrefs: 0040BF70
46A, xrefs: 0040BF85

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5de4b720525195bfa21f7211d5f61df3d951c59e2526b8a2204b20cbe9ca94a4
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5de4b720525195bfa21f7211d5f61df3d951c59e2526b8a2204b20cbe9ca94a4
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_DOMAIN, xrefs: 0040B44B
%P5DATE, xrefs: 0040B4F2
%TO_USER, xrefs: 0040B488
%s@%s, xrefs: 0040B461
%FROM_EMAIL, xrefs: 0040B3E9
%FROM_USER, xrefs: 0040B431
%TO_EMAIL, xrefs: 0040B473
%M5DATE, xrefs: 0040B50F
%DATE, xrefs: 0040B4D2
%TO_HASH, xrefs: 0040B4B0
%FROM_DOMAIN, xrefs: 0040B41E

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 07bf672bddbe06c2f420d96725ac0e1f54ef040b4224a6cef6ca6ba202742de3
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: 07bf672bddbe06c2f420d96725ac0e1f54ef040b4224a6cef6ca6ba202742de3
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 029C1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 029C202D
GetSystemInfo.KERNEL32(?), ref: 029C204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 029C206A
GetProcAddress.KERNEL32(00000000), ref: 029C2071
GetCurrentProcess.KERNEL32(?), ref: 029C2082
GetTickCount.KERNEL32 ref: 029C2230

Part of subcall function 029C1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 029C1E7C

Strings

localcfg, xrefs: 029C2091, 029C2098, 029C20AB, 029C20E4, 029C20F3, 029C2119, 029C2138, 029C214E, 029C2166, 029C2183, 029C219B, 029C21B7, 029C21D7
work_srv, xrefs: 029C20C5
flags_upd, xrefs: 029C20A5, 029C20AA, 029C20E3
hi_id, xrefs: 029C217D, 029C2182, 029C219A

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 8759b384ef9c726a355504968f42c8b33284226090dfd069cf01c6516c8590ef
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 8A51F9B09003486FE330AF758C85F67BAECEF94744F50491DFD9682242D7B9A544CB66

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7686EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7686EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 66737db9b915561633ae3f492ee5f4d9e9eb10476a5fdfc482486e88eb260942
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: 66737db9b915561633ae3f492ee5f4d9e9eb10476a5fdfc482486e88eb260942
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: a4c47fe232f0f429a5e45ffdfbe97dd16a9fcdfbaa8a3ef520d6a4c94dc9225a
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: a4c47fe232f0f429a5e45ffdfbe97dd16a9fcdfbaa8a3ef520d6a4c94dc9225a
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 029C3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 029C3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 029C3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 029C3095
RtlAllocateHeap.NTDLL(00000000), ref: 029C30B6
htons.WS2_32(00000035), ref: 029C30EF
inet_addr.WS2_32(?), ref: 029C30FA
gethostbyname.WS2_32(?), ref: 029C310D
HeapFree.KERNEL32(00000000), ref: 029C314D

Strings

iphlpapi.dll, xrefs: 029C3062, 029C3067, 029C3077

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: fa11eb47cb8194c02ae31ca194d93498a462f97c43744243d53d5c5a7d7f060f
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 1331A431A00206AFDB119BB89C48BAE77BCAF05764F24C1A9E518E7390DB74D5418B5E

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: eb7510e18f4f3ad5f9c27a48c5e533d648c270866267e0b44efdedb47f858b72
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: eb7510e18f4f3ad5f9c27a48c5e533d648c270866267e0b44efdedb47f858b72
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 029C6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 029C67C3
htonl.WS2_32(?), ref: 029C67DF
htonl.WS2_32(?), ref: 029C67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 029C68F1
ExitProcess.KERNEL32 ref: 029C69BC

Strings

localcfg, xrefs: 029C6994
except_info, xrefs: 029C698F

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 8849537c9c5f5bf11510654b3a9c2b8103dccafd7bb4a38027b52a977126109b
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: FD617E71A40208AFDB609FB4DC45FEA77E9FB48300F24806AFA6DD2161EB759990CF14

Function 029CF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(029CCC84), ref: 029CF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 029CF5CE
closesocket.WS2_32(00000000), ref: 029CF5DC

Strings

time_cfg, xrefs: 029CF58A

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 6b45681ec4d6f7db941ec21eb8b8ecd9fd83cdc8d2ecca41462ff660efa488bf
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: D9316E7290011CABDB10DFA5DC88DEE7BBDEF88314F20456AF915D3150E7709A81CBA5

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 029C2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 029C2FA1
LoadLibraryA.KERNEL32(?), ref: 029C2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 029C2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 029C3000
RtlAllocateHeap.NTDLL(00000000), ref: 029C3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 029C3032

Strings

dnsapi.dll, xrefs: 029C2F90

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 5524188a049d1c4babbcc403d8234a90db8a19823d9511f9bcc805e463a7bdb0
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: E621A771D00619BBCB21DF54DC44AEEBBBCEF08B10F108465F901E7540D7749A8187E9

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: bb3a68048dca612602b0c8d6e49c283fb6b7b0927c26922aed4f6a4c5afedb24
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: bb3a68048dca612602b0c8d6e49c283fb6b7b0927c26922aed4f6a4c5afedb24
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 029C6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\fdcgtgix,029C7043), ref: 029C6F4E
GetProcAddress.KERNEL32(00000000), ref: 029C6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 029C6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 029C6F92

Strings

C:\Windows\SysWOW64\, xrefs: 029C6F30, 029C6F38, 029C6F65, 029C6F6C, 029C6F7A, 029C6F85, 029C6F91, 029C6FA9, 029C6FC6, 029C6FEC
\\.\pipe\fdcgtgix, xrefs: 029C6F37
PromptOnSecureDesktop, xrefs: 029C6F9D, 029C6FBF, 029C6FCF, 029C6FE5, 029C6FF5

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\fdcgtgix
API String ID: 1082366364-520682941
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 6167e80366f3b58c416d873eca87d69aedbf6447538bf1d98ef4d86c26bdcfce
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: B521F3217413407AF72297319C88FFB2E4D8B92724F2840ADF844E6591DBD984D687AF

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 029C92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 029C92E2
wsprintfA.USER32 ref: 029C9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 029C9375
lstrlen.KERNEL32(?,?,00000000), ref: 029C9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 029C9394
CloseHandle.KERNEL32(00000000), ref: 029C939B

Strings

PromptOnSecureDesktop, xrefs: 029C932B, 029C9343, 029C935E

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: d7a9b2d26258fb76366f848d1ec9b5b3b70627850d9a57f004fd3b9618b4f11c
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: F71172B17401147BE7206771EC0DFEF3A6EDBC8B10F108079BB0AA5090EAB54A418B65

Function 029C99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 029C9A18
GetThreadContext.KERNEL32(?,?), ref: 029C9A52
TerminateProcess.KERNEL32(?,00000000), ref: 029C9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 029C9A98
SetThreadContext.KERNEL32(?,00010002), ref: 029C9AB5
ResumeThread.KERNEL32(?), ref: 029C9AC2

Strings

D, xrefs: 029C9A10

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 93b5125ee430950a87c3979bb526f3d411eb504b9bdfd600483675ae6048ffec
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 58213BB1A01219BBEB11DBA1DC09EEF7BBCEF04750F504065FA19E5050E7758A44CBA5

Function 029C1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 029C1C18
LoadLibraryA.KERNEL32(004102C8), ref: 029C1C26
GetProcessHeap.KERNEL32 ref: 029C1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 029C1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 029C1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 029C1D02
FreeLibrary.KERNEL32(?), ref: 029C1D0B

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: a31df93a1759c4dabd3d2f0eb0f92c09f5d450c39bc024064a92b5b35994c360
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: CE315C32E00209BFCB119FA4DC888EEBAB9EF45315B34447EF509A2111D7B54E80DB99

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: ef12e745c0d8ac77b0bd51427e5f83480508b91c038ebc09813fba6640af01bf
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: ef12e745c0d8ac77b0bd51427e5f83480508b91c038ebc09813fba6640af01bf
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 029C6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 029C6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 029C6D22
GetLastError.KERNEL32 ref: 029C6DA7
CloseHandle.KERNEL32(?), ref: 029C6DB5
GetLastError.KERNEL32 ref: 029C6DD6
DeleteFileA.KERNEL32(?), ref: 029C6DE7
GetLastError.KERNEL32 ref: 029C6DFD

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 7f60ee9415d0823f8afd5d4e8b8df0818a9553f689188d3f70b220d75faeee87
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 9631E376900249BFCB01DFA4DD44ADE7FBDEF88310F24847AE251E3250D7708A558BA6

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 029C93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 029C93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 029C93CD
CharToOemA.USER32(?,?), ref: 029C93DB
wsprintfA.USER32 ref: 029C9410

Part of subcall function 029C92CB: GetTempPathA.KERNEL32(00000400,?), ref: 029C92E2
Part of subcall function 029C92CB: wsprintfA.USER32 ref: 029C9350
Part of subcall function 029C92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 029C9375
Part of subcall function 029C92CB: lstrlen.KERNEL32(?,?,00000000), ref: 029C9389
Part of subcall function 029C92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 029C9394
Part of subcall function 029C92CB: CloseHandle.KERNEL32(00000000), ref: 029C939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 029C9448

Strings

PromptOnSecureDesktop, xrefs: 029C93FA, 029C93FF, 029C941C

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: a2da427887c117fbf8499d8352bd0e1b664af9504d65fcedf9bc2a4268d80c46
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 790152F69001187BE721A7619D89EDF377CDB95701F0040A6BB49E2080DAB497C58F75

Function 029CAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 029CAAE5

Strings

localcfg, xrefs: 029CAD72
, xrefs: 029CABB3

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 673fe83b06efaa2e9f65a32284bb6c59a4ecb582d53ca7c7b2ff62d10f249c11
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 45712971A4030CAADF218E94EC85FEE376EAF40719F34446FF905A60D0DF6299848B5B

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 029CE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 029CDF6C: GetCurrentThreadId.KERNEL32 ref: 029CDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 029CE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,029C6128), ref: 029CE950
lstrcmp.KERNEL32(?,00000008), ref: 029CE989

Strings

A, xrefs: 029CE8C6, 029CE8CD, 029CE936, 029CE998
A, xrefs: 029CE960, 029CE965
A, xrefs: 029CE9A0

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 82ac7471e01db044a2f895092095ee5ad02195c1b0468331dfc33b417454f9d6
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 01319C31A047059BDB79CF24C884BA67BE8FB09764F60892EE5D687651D370E880CB93

Function 029C6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 029C6E19

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: f14f9e44d49d42ea3763d8802c7cf9e727fadc1c69f2bde0a95850e4be8feab1
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 982142B2104119FFDB119BB1FC48EDF7FADDB896A5B20842AF502D2090EB70DA50D675

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,771B0F10,?,00000000,0040E538,?,771B0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 029CC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 029CC6B4
InterlockedIncrement.KERNEL32(029CC74B), ref: 029CC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,029CC747), ref: 029CC728
CloseHandle.KERNEL32(00000000,?,029CC747,00413588,029C8A77), ref: 029CC733

Strings

localcfg, xrefs: 029CC544

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: b248d93761d5b1b270cdf1511e9b86a98c9c98524d2189ee261f77e41f6cf9c9
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 16514BB1A01B468FD7249F69C6D462ABBE9FB48304B60593FE18BC7A90D774F844CB11

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,771B0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: 50e144e5c66517dd62c9eb504a4f9f7b4843c8d6198543f26dab993f1630d953
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 50e144e5c66517dd62c9eb504a4f9f7b4843c8d6198543f26dab993f1630d953
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 029CE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,029CE50A,00000000,00000000,00000000,00020106,00000000,029CE50A,00000000,000000E4), ref: 029CE319
RegSetValueExA.ADVAPI32(029CE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029CE38E
RegDeleteValueA.ADVAPI32(029CE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029CE3BF
RegCloseKey.ADVAPI32(029CE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,029CE50A), ref: 029CE3C8

Strings

PromptOnSecureDesktop, xrefs: 029CE33A

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: ba775650c145f99a1908e57553c5c162a75460460757242659337fc9964162c6
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 00214A71A0021DABDF219FA4EC89EEE7F7DEF08760F108025F945A6150E3719A54DBA1

Function 029C71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 029C71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029C7228
LocalFree.KERNEL32(?,?,?), ref: 029C7286
wsprintfA.USER32 ref: 029C729D

Strings

|, xrefs: 029C721A

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 73079d3558238009d5b9ed7756f381ba905b9ac302e2fafb62525d234aff1b5b
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: A5311A72900208BBDB01DFA8DC45BDA7BADEF04314F24C06AF959DB244EB75D6488F95

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 029CB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 029CB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 029CB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 029CB548
GetTimeZoneInformation.KERNEL32(?), ref: 029CB590
wsprintfA.USER32 ref: 029CB61E

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 6a8e380ccb890cad47d0e2eb1f8e2467e23cfd5fbf209ed6805b59745499288e
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: A85130B1D0021CAACF14CFD5D8899EEBBB9BF48304F10812AF501B6150E7B84AC9CF98

Function 029C62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 029C6303
LoadLibraryA.KERNEL32(?), ref: 029C632A
GetProcAddress.KERNEL32(00000000,?), ref: 029C63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 029C6405

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: a66c792c0b583b6da9f7d32b37722633001d7139c40a0fd01ece10e126d50b6c
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 49414CB1A04209EFDB14CF58C884BA9B7BCFF84358F24856DE865D7290E771E941CB51

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(771B0F18,00000000,?,771B0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,771B0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,771B0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 53a70ba93e4b2c34d413b9add9e26c4f8e9f0de61643a904c0250f6f0d42246e
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: 53a70ba93e4b2c34d413b9add9e26c4f8e9f0de61643a904c0250f6f0d42246e
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,771B0F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,771B0F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,771B0F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: e52c754b5c4df7ac7535869be25ad2b94008d4c8a4726cb9c757c49838e9d70c
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: e52c754b5c4df7ac7535869be25ad2b94008d4c8a4726cb9c757c49838e9d70c
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 029CE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 029CDF6C: GetCurrentThreadId.KERNEL32 ref: 029CDFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,029CA6AC), ref: 029CE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,029CA6AC), ref: 029CE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,029CA6AC), ref: 029CE819

Strings

PromptOnSecureDesktop, xrefs: 029CE840, 029CE845, 029CE87C, 029CE89B

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: c43398b038594cb4ff01351c96befb7af9fc1b3f72a9ad83e863073f25b2a0f2
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 8821F9B1A443007AF22177219C45FEB3E1DDFA5B60F30003DFA4AB51D3EA5595508AB7

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 5c3f6046797f5d804895e4c05c4277987be728c98b5bed37973dbb72bca93dd1
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 5c3f6046797f5d804895e4c05c4277987be728c98b5bed37973dbb72bca93dd1
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 029C7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 029C76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 029C796D
RegCloseKey.ADVAPI32(?), ref: 029C797E

Strings

PromptOnSecureDesktop, xrefs: 029C76C5, 029C76CA, 029C76E5

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 91a9d41131a10e96f2bf09e3571275dee73db3935cb63376c038fba62acd15bf
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 3911CA70A00109AFDB119BA9EC44EEEBF7DAB81714F240169F510E6290E3B08A408F62

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: c32bd2a19c33d57a97dc38e480cb8eff028dd4ac8e1228206779d83c5918f3cf
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: c32bd2a19c33d57a97dc38e480cb8eff028dd4ac8e1228206779d83c5918f3cf
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 029C9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 029C999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 029C99BD
RegCloseKey.ADVAPI32(?), ref: 029C99C6

Strings

PromptOnSecureDesktop, xrefs: 029C9989, 029C998E, 029C99B0, 029C99D3

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: b6573a5a3e1ca7dce4bb35ad655fdf95d54669ddeff2ecbc6e82aa0dae34fd37
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: F1F0F6B2A80208BBF7106B54EC46FDB3A2DDB94B10F200075FA05B5081F6E59B9086BA

Function 029C28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 029C28FA
gethostbyname.WS2_32(u6A), ref: 029C2906

Strings

time_cfg, xrefs: 029C28EB
u6A, xrefs: 029C28EC, 029C28F9, 029C2905

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 23ce6c5d49f2aec6002fa53e00286fc9d37299601e7585bb6a782c5292ac9aaf
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9FE01230A085119FDB50DB2CF848AD577E9EF4A230F158599F854D71A0C774DCC19755

Function 029C69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 029C69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 029C6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 029C6A3A
CloseHandle.KERNEL32(000000FF), ref: 029C6BD8

Part of subcall function 029CEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,029C1DCF,?), ref: 029CEEA8
Part of subcall function 029CEE95: HeapFree.KERNEL32(00000000), ref: 029CEEAF

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: c9c750c142d375a173ee5b41ecce7a9b3900eaa96eae165cd73d39ebaa0fc3c2
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 9171057190421DEFEB11DFA4CC80AEEBBBDFB48354F20456EE515A6190D7309E92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 029C41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 029C421F
GetLastError.KERNEL32 ref: 029C4229
WaitForSingleObject.KERNEL32(?,?), ref: 029C423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 029C424D

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: b1d0fe786a3419c8af4a0debf174dd513f3fa537d0f51993fe313a0ac2f4aa59
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 5701C472A11209AFDF01DF90EE85BEF7BACEB08256F108465F901E6050D770EA548BB6

Function 029C417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 029C41AB
GetLastError.KERNEL32 ref: 029C41B5
WaitForSingleObject.KERNEL32(?,?), ref: 029C41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 029C41D9

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: cc52364752808eeb0dd046eae7273d1ec9d7cba023f9e7642f912381b9c5a22f
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 30010C7651110AAFDF01DF90ED88BEF7B6CEB18295F104065F901E2150D770DA548BB6

Function 029CE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 029CE066

Strings

A, xrefs: 029CE037, 029CE03C
A, xrefs: 029CE07F
A, xrefs: 029CE036

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 2124820c3ce42339cdb9a13c9e1a4ebda46d1664827d2d333bd0a44f0e42c532
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: FCF062312047069BCB30CF25D884A92B7EDFB05335B64862EE596D3060D374A498CB96

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: a7932ee6e11f51e31df66d5708ae860d6aff00331a4d04ea59eecfc3ddd3bc48
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: a7932ee6e11f51e31df66d5708ae860d6aff00331a4d04ea59eecfc3ddd3bc48
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 029CE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,029C44E2,00000000,00000000,00000000), ref: 029CE470
CloseHandle.KERNEL32(00000001,00000003), ref: 029CE484

Part of subcall function 029CE2FC: RegCreateKeyExA.ADVAPI32(80000001,029CE50A,00000000,00000000,00000000,00020106,00000000,029CE50A,00000000,000000E4), ref: 029CE319
Part of subcall function 029CE2FC: RegSetValueExA.ADVAPI32(029CE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029CE38E
Part of subcall function 029CE2FC: RegDeleteValueA.ADVAPI32(029CE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029CE3BF
Part of subcall function 029CE2FC: RegCloseKey.ADVAPI32(029CE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,029CE50A), ref: 029CE3C8

Strings

PromptOnSecureDesktop, xrefs: 029CE4F1, 029CE4F6, 029CE537, 029CE561

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 45da85043db2864e4522c4220e3edcd89d6ce4fd9aa1155bd31e343463be4764
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: D541D6B2D00218BBEF206F518C45FEB3B6DEB44764F24803DFE4A94091E7B59650DAB6

Function 029C8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 029C83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 029C8477

Part of subcall function 029C69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 029C69E5
Part of subcall function 029C69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 029C6A26
Part of subcall function 029C69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 029C6A3A

Part of subcall function 029CEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,029C1DCF,?), ref: 029CEEA8
Part of subcall function 029CEE95: HeapFree.KERNEL32(00000000), ref: 029CEEAF

Strings

PromptOnSecureDesktop, xrefs: 029C83B2, 029C83B7, 029C8483

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 9b6d129aba509a7c9fdb47b5cc25dad3d991a12577dcda7d8640d592dded57ec
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: C7415FB2900109BFEB12EBA09D80EFF776EFB44344F2444AEE549D7150E7B05A948B66

Function 029CE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,029CE859,00000000,00020119,029CE859,PromptOnSecureDesktop), ref: 029CE64D
RegCloseKey.ADVAPI32(029CE859,?,?,?,?,000000C8,000000E4), ref: 029CE787

Strings

PromptOnSecureDesktop, xrefs: 029CE637

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: b93a31c7f05ea214b643ee3ea18ef720372e9914e1e03c115ba9e04612098848
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 4B4106B2D0011DBFDF11AF94DC85EEEBB7EEB04304F24446AEA01B6150E3719A559B61

Function 029CAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 029CAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 029CB00D

Part of subcall function 029CAF6F: gethostname.WS2_32(?,00000080), ref: 029CAF83
Part of subcall function 029CAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 029CAFE6

Part of subcall function 029C331C: gethostname.WS2_32(?,00000080), ref: 029C333F
Part of subcall function 029C331C: gethostbyname.WS2_32(?), ref: 029C3349

Part of subcall function 029CAA0A: inet_ntoa.WS2_32(00000000), ref: 029CAA10

Strings

%OUTLOOK_BND_, xrefs: 029CB076, 029CB07B, 029CB0BE, 029CB0DD

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 5f299d56529433ac0a21e47bac1110e2f808d6c19789518a3d0d4cc3733ad488
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: B441817290024CABDB21EFA0DC45EEE3BAEFF48314F24442BF92992151EA75DA448F55

Function 029C9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 029C9536
Sleep.KERNEL32(000001F4), ref: 029C955D

Strings

, xrefs: 029C94D9

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: f87978965b4a2b29d063abacdbb5c20b0ab5d4dc25f930011aee6ef7d443f850
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 324127B18083D46EFB368B64D89C7B63BAC9B02314F3400ADD88697192D7744980C723

Function 029CBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 029CB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 029CBA3A
InterlockedIncrement.KERNEL32(?), ref: 029CBA94
GetTickCount.KERNEL32 ref: 029CBB79
GetTickCount.KERNEL32 ref: 029CBB99
InterlockedIncrement.KERNEL32(?), ref: 029CBE15
closesocket.WS2_32(00000000), ref: 029CBEB4

Strings

%FROM_EMAIL, xrefs: 029CBC7D

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 45b40c7df081a157735c01f3d751bf5e120392ed1cabed12d100dcd8f9d04202
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: A1319CB1400248DFDF24DFA4DC95BEAB7B9EB48704F20446AFA2493160DB30DA85CF52

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f585014306f6c3250efaa4e73719a74caf3cdfa730fd8078cc8a6a0845b45eb1
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f585014306f6c3250efaa4e73719a74caf3cdfa730fd8078cc8a6a0845b45eb1
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 07e354698f15fd9fc768e13d315d3543d6c442699b8c7836c4f7c54cdd5a5fd6
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: 07e354698f15fd9fc768e13d315d3543d6c442699b8c7836c4f7c54cdd5a5fd6
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 029C709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 029C70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 029C70F4

Strings

|, xrefs: 029C70E6

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 229773682f4de4b77a5085649330724ef488e8eb64a74401effa05ddb920840c
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 3B11FA72900118EBDB11CFD4DC84AEEB7BDAB04719F2481AAE501E6294D7709B88CFA1

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7686EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.3691594909.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3691594909.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 44b2ceadd519ca45f912a616d592807794313ca1f1de80b4bcf7ee55ccb8d493
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 44b2ceadd519ca45f912a616d592807794313ca1f1de80b4bcf7ee55ccb8d493
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 029C3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 029C2F88: GetModuleHandleA.KERNEL32(?), ref: 029C2FA1
Part of subcall function 029C2F88: LoadLibraryA.KERNEL32(?), ref: 029C2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 029C31DA
HeapFree.KERNEL32(00000000), ref: 029C31E1

Memory Dump Source

Source File: 00000000.00000002.3695092546.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_vyrcclmm.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: a012d79f59e986a63eb59656a3aa4b658dd50b46dbb3bc9664c265d8c596cdef
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: E9517D7190024AAFCF01DF64D888AFAB779FF05305F2485A9EC96C7210E732DA19CB95

Analysis Process: pspizbvl.exePID: 7016, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	0%
Total number of Nodes:	1550
Total number of Limit Nodes:	12

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\vyrcclmm.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 00409EDB
", xrefs: 0040A189
bzycpcet, xrefs: 0040A389, 0040A397
C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 0040A1D9
", xrefs: 0040A078
D, xrefs: 00409F8E
%X%08X, xrefs: 0040A0B0
\, xrefs: 00409D0C
P, xrefs: 00409DAA
C:\Users\user\Desktop\vyrcclmm.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\vyrcclmm.exe$C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe$D$P$\$bzycpcet
API String ID: 2089075347-4077984937
Opcode ID: 51b3fdeb16769e607b7420a4e79e81e5addf88b96e881b4fbfa3e3990a533921
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 51b3fdeb16769e607b7420a4e79e81e5addf88b96e881b4fbfa3e3990a533921
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: ee9ff6285cd0759b386b71dc2009f55f092fb3ff13d227db5bcc73c144141d81
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: ee9ff6285cd0759b386b71dc2009f55f092fb3ff13d227db5bcc73c144141d81
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,771B0F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,771B0F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,771B0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,771B0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,771B0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: fb32ede88c892ccab39cf83d003fcbea33a4e2e8563a4575a47fd59e5a1c2ade
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: fb32ede88c892ccab39cf83d003fcbea33a4e2e8563a4575a47fd59e5a1c2ade
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 029B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 029B024D

Strings

cess, xrefs: 029B018D
kernel32.dll, xrefs: 029B008F, 029B0095

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 42523d658734be5adc1b1daf10dbf1cb7dd777a4bc5754a5a5006f2d178b3ac3
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 87527974A01229DFDB65CF68C984BADBBB5BF09304F1480D9E94DAB351DB30AA85CF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: ef12e745c0d8ac77b0bd51427e5f83480508b91c038ebc09813fba6640af01bf
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: ef12e745c0d8ac77b0bd51427e5f83480508b91c038ebc09813fba6640af01bf
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 4febc6132cbb2eeae90f99f22907b6d3a51082cd0e0b87a57774915eab482f02
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 4febc6132cbb2eeae90f99f22907b6d3a51082cd0e0b87a57774915eab482f02
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 029F1804 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 029F182C
Module32First.KERNEL32(00000000,00000224), ref: 029F184C

Memory Dump Source

Source File: 00000014.00000002.1689220789.00000000029ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 029ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29ed000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: cba2cb0b45bd6d53a6d8831e4b0acdeebb2af896d453985cd3259d8ea534d757
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 2CF09632100711AFD7A03BF99D8DBAE76ECEF49625F100528E75A924C0DB70E8454BA1

Function 029B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,029B0223,?,?), ref: 029B0E19
SetErrorMode.KERNELBASE(00000000,?,?,029B0223,?,?), ref: 029B0E1E

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 8c5091a75a8c552e1507ec5e9f2876851e53a5403109e6d851cc54e5729abfa9
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 16D01236245228B7DB012AD4DC09BCEBB1CDF09BA6F008021FB0DE9080CBB09A4046EA

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 029F14C3 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 029F1514

Memory Dump Source

Source File: 00000014.00000002.1689220789.00000000029ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 029ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29ed000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: bcf653143fe7555b77d3e2938ebd3bb25af154afe3661a71047874b8bac371ea
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A2113C79A00208EFDB41DF98C985E99BFF5AF08350F158094FA489B361D371EA50DF80

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 029B65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 029B65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 029B6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 029B6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 029B6652

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 2e641a22c38312b16daaee350788746e9877bd09c76a33a2abd2fb289dc01123
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 36113D71600218BFDB229F75DD49FDB3FACEF457A5F104024FA08A6250D7B1ED508AA4

Function 029B9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 029B9E6D
lstrcpy.KERNEL32(?,00000000), ref: 029B9FE1
lstrcat.KERNEL32(?,?), ref: 029B9FF2
lstrcat.KERNEL32(?,0041070C), ref: 029BA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 029BA054
DeleteFileA.KERNEL32(?), ref: 029BA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 029BA0D6
lstrcpy.KERNEL32 ref: 029BA12F
lstrlen.KERNEL32(00000022), ref: 029BA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 029B9F13

Part of subcall function 029B7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 029B7081

Part of subcall function 029B6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\fdcgtgix,029B7043), ref: 029B6F4E
Part of subcall function 029B6F30: GetProcAddress.KERNEL32(00000000), ref: 029B6F55
Part of subcall function 029B6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 029B6F7B
Part of subcall function 029B6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 029B6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 029BA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 029BA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 029BA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 029BA21B
GetDriveTypeA.KERNEL32(?), ref: 029BA265
lstrcat.KERNEL32(?,00000000), ref: 029BA29F
lstrcat.KERNEL32(?,00410A34), ref: 029BA2C5
lstrcat.KERNEL32(?,00000022), ref: 029BA2D9
lstrcat.KERNEL32(?,00410A34), ref: 029BA2F4
wsprintfA.USER32 ref: 029BA31D
lstrcat.KERNEL32(?,00000000), ref: 029BA345
lstrcat.KERNEL32(?,?), ref: 029BA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 029BA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 029BA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 029BA1D1

Part of subcall function 029B9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 029B999D
Part of subcall function 029B9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 029B99BD
Part of subcall function 029B9966: RegCloseKey.ADVAPI32(?), ref: 029B99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 029BA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 029BA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 029BA41D

Strings

", xrefs: 029BA3F0
P, xrefs: 029BA011
\, xrefs: 029B9F73
D, xrefs: 029BA1F5
", xrefs: 029BA2DF
", xrefs: 029BA142

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 9d0296501e0905c2d4e9aa8298a28ff9b280062e846319ef1dd94a5fb444024c
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 26F141B1D4025DAFDF22DBA08E48FEE7BBDAF09304F0444A6E605E2151E7759A848F64

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtDuplicateToken, xrefs: 004011F3
RtlNtStatusToDosError, xrefs: 00401194
RtlInitUnicodeString, xrefs: 00401135
NtClose, xrefs: 004011B4
NtFilterToken, xrefs: 0040122B
NtTerminateProcess, xrefs: 004010F6
NtQueryInformationToken, xrefs: 00401262
NtOpenProcessToken, xrefs: 004011D4
NtSetInformationToken, xrefs: 00401175
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlSetLastWin32Error, xrefs: 004010D6
NtSetInformationThread, xrefs: 00401155
ntdll.dll, xrefs: 0040100D
RtlFreeSid, xrefs: 00401116
RtlLengthSid, xrefs: 00401246

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: def56848a29238af3b3263ec016d123599b8ce3514d2c8bce6aae186bf62253e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: def56848a29238af3b3263ec016d123599b8ce3514d2c8bce6aae186bf62253e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Jun, xrefs: 0040B279
Tue, xrefs: 0040B233
Jul, xrefs: 0040B280
Oct, xrefs: 0040B295
Wed, xrefs: 0040B23A
Sep, xrefs: 0040B28E
Apr, xrefs: 0040B26B
Sat, xrefs: 0040B24F
Fri, xrefs: 0040B248
Nov, xrefs: 0040B29C
Jan, xrefs: 0040B256
May, xrefs: 0040B272
Sun, xrefs: 0040B225
Feb, xrefs: 0040B25D
Aug, xrefs: 0040B287
Thu, xrefs: 0040B241
Mar, xrefs: 0040B264
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Dec, xrefs: 0040B2A3
Mon, xrefs: 0040B22C

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 9c254f7c2f4551e4858b08560ebcfb375181b6b247abdacfd65a4178375c92cf
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: 9c254f7c2f4551e4858b08560ebcfb375181b6b247abdacfd65a4178375c92cf
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe$D
API String ID: 2976863881-1834141438
Opcode ID: eb1a08a2c71bfc4e71cb34ece599553e47f8ddafd4bc37f5bbc1e22e926e6740
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: eb1a08a2c71bfc4e71cb34ece599553e47f8ddafd4bc37f5bbc1e22e926e6740
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 029B7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 029B7D21
GetUserNameA.ADVAPI32(?,?), ref: 029B7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029B7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 029B7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 029B7DC0
EqualSid.ADVAPI32(?,?), ref: 029B7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 029B7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029B7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 029B7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 029B7E12
LocalFree.KERNEL32(00000000), ref: 029B7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 029B7E35

Strings

D, xrefs: 029B7D73
C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 029B7F49, 029B7F76, 029B7F8A, 029B7F8B

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe$D
API String ID: 2976863881-1834141438
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 7c7ba836c86b22620e20ab916512d3a3523af567d24313c1bda3c30b58163d96
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 06A14B72900219AFDB128FA0DE88FEEBBBDFF48744F04816AF505E6150D7758A85CB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728
plgs:, xrefs: 004066AA
va=%08X%08X uef=%p, xrefs: 00406595
%d=%p, xrefs: 004066F9
Jan 13 2018, xrefs: 0040653A
12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 61f8b68dd9f344f506cfc8e29852887e470a3443c6047e34725b67e0d060e89d
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: 61f8b68dd9f344f506cfc8e29852887e470a3443c6047e34725b67e0d060e89d
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

mail from:<%s>, xrefs: 0040A848
., xrefs: 0040A8CA
AUTH LOGIN, xrefs: 0040A80C
ESMTP, xrefs: 0040AA38
Incorrect respons, xrefs: 0040AB39
Too big smtp respons (%d bytes), xrefs: 0040A9B1
data, xrefs: 0040A85E
quit, xrefs: 0040A86C
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
rcpt to:<%s>, xrefs: 0040A855
Too small respons, xrefs: 0040A9C9
helo %s, xrefs: 0040A803
ehlo %s, xrefs: 0040A7F5
localcfg, xrefs: 0040AB0B

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ae3e940a4bde8c590484db18a6dae5c4a8b1995a6f5a2f6c6eb5761f3b661a67
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ae3e940a4bde8c590484db18a6dae5c4a8b1995a6f5a2f6c6eb5761f3b661a67
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 93d2068cc19732fe8ad9ae0a9f51e86421eb0c8fa32be1230cd8688bd4bd79d5
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: 93d2068cc19732fe8ad9ae0a9f51e86421eb0c8fa32be1230cd8688bd4bd79d5
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 029B7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 029B7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029B7ACD
GetLengthSid.ADVAPI32(?), ref: 029B7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 029B7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 029B7B1F
EqualSid.ADVAPI32(?,?), ref: 029B7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 029B7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029B7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 029B7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 029B7B77
LocalFree.KERNEL32(00000000), ref: 029B7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 029B7B9A
GetAce.ADVAPI32(?,?,?), ref: 029B7BCA
EqualSid.ADVAPI32(?,?), ref: 029B7BF1
DeleteAce.ADVAPI32(?,?), ref: 029B7C0A
EqualSid.ADVAPI32(?,?), ref: 029B7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 029B7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029B7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 029B7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 029B7CE0
LocalFree.KERNEL32(00000000), ref: 029B7CEE

Strings

D, xrefs: 029B7AC3

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: f654d0ebd20af280c1c699e3fd905bd77509bb0b3fcbacd0931144b6a0a99d2b
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 20813D72900219AFDB12CFE4DE88FEEBBBCAF48305F04816AE505E6250D7759A45CF64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 004085C8, 004085D5, 004085E5
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe$localcfg
API String ID: 237177642-1129100248
Opcode ID: 15b9b55687a82b41d6800692092713c8c708d1165b0f2aaaab3cbeed006d9429
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 15b9b55687a82b41d6800692092713c8c708d1165b0f2aaaab3cbeed006d9429
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

uac, xrefs: 00401628
wusa.exe, xrefs: 00401388
, xrefs: 00401462
<, xrefs: 00401378
useless, xrefs: 0040161E
D, xrefs: 004015C6
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 4a22ad167bc3991e7243980079933dba70382744969d1905516b1f864c22465e
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 4a22ad167bc3991e7243980079933dba70382744969d1905516b1f864c22465e
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

IsWow64Process, xrefs: 00401DF2
net_type, xrefs: 00401E87
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
lid_file_upd, xrefs: 00401E25
start_srv, xrefs: 00401E6C
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
kernel32, xrefs: 00401DF7
born_date, xrefs: 00401EAD, 00401ECC
loader_id, xrefs: 00401F4B, 00401F6B
work_srv, xrefs: 00401E5E
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC
123.45.67.89, xrefs: 004019A6
GetBestInterface, xrefs: 004019EF
Iphlpapi.dll, xrefs: 004019B7
localcfg, xrefs: 004019A3

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: c2d043fcc5cbb47ed0bea78f2b79b5e209498882ff798d96aae41c0d31e4dbc2
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: c2d043fcc5cbb47ed0bea78f2b79b5e209498882ff798d96aae41c0d31e4dbc2
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 029B858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 029B865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 029B867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 029B86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 029B86B1

Strings

", xrefs: 029B896C
C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 029B882F, 029B883C, 029B884C

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe
API String ID: 237177642-2047947632
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 128f38fcc887b322a511e1dd8b67b7c755268c2cc85ed0bd091818acd99c2f06
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 88C17F71900149BFEF12ABA4DE89EEE7BBDEF48304F144066F604A6050E7714A948B65

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,771AF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,771AF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 029B14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 029B1601
lstrlenW.KERNEL32(-00000003), ref: 029B17D8

Strings

D, xrefs: 029B182D
@, xrefs: 029B15E7
, xrefs: 029B16C9
<, xrefs: 029B15DF

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: df3caf3a0597b9f19cd2fbfeb3b8e886828a1896a4627902182df770bcccf36e
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: D4F1ACB11083819FD721CF64C998BEBB7E9FF88304F10892DF59A972A0D7B49944CB56

Function 029B7666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 029B76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 029B7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 029B778F
___ascii_stricmp.LIBCMT ref: 029B78B4
RegCloseKey.ADVAPI32(?), ref: 029B794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 029B796D
RegCloseKey.ADVAPI32(?), ref: 029B797E
RegCloseKey.ADVAPI32(?), ref: 029B79AC
RegCloseKey.ADVAPI32(?), ref: 029B7A56

Part of subcall function 029BF40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,029B772A,?), ref: 029BF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 029B79F6
RegCloseKey.ADVAPI32(?), ref: 029B7A4D

Strings

", xrefs: 029B7800

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 6f5b54e8bedef0f98781eeb8a28d7cd6d8db4efced1db3dc229972a8566402c9
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 52C17372900209AFDB12DBE4DE44FEEBBBDEF89710F1441A5E544E6190EB71DA84CB60

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,771B0F10,?,771B0F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(771B0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,771B0F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(771B0F10,?,771B0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(771B0F10), ref: 00407208
RegCloseKey.ADVAPI32(771B0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(771B0F10), ref: 004072D0
RegCloseKey.ADVAPI32(771B0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(771B0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 618cfb6f1b26c540220dcc2678a44076c62346fd56d5638b59146fa8fa35b1d5
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 618cfb6f1b26c540220dcc2678a44076c62346fd56d5638b59146fa8fa35b1d5
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 00409326 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 029B2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 029B2CED
socket.WS2_32(00000002,00000002,00000011), ref: 029B2D07
htons.WS2_32(00000000), ref: 029B2D42
select.WS2_32 ref: 029B2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 029B2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 029B2E62

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: a844754e445bd0e1a5e81102e49a2f9bdfbb3dfbc358388cf5ba20d742e5a797
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 9A61EF71904305ABC322AF65DD08BEBBBECEF88745F004829FD8497160D7B4D880CBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
127.0.0.1, xrefs: 0040ADEB
%s%d, xrefs: 0040AE58

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 5cd659d1eb2281404cf1ff7fe35be06c0bda1c6b56bcdef19fd154bc71bc5665
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: 5cd659d1eb2281404cf1ff7fe35be06c0bda1c6b56bcdef19fd154bc71bc5665
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,771B23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: d8108df1af11397a5f9eb0cb94d23b6045a7de0830802216e32b8eab0121211e
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: d8108df1af11397a5f9eb0cb94d23b6045a7de0830802216e32b8eab0121211e
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,771B0F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,771B0F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,771B0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,771B0F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,771B0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: e164254f3378dd396073a59d5f8bf438da5901e9f91fe2d8a4805c76184d12e6
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: e164254f3378dd396073a59d5f8bf438da5901e9f91fe2d8a4805c76184d12e6
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_EMAIL, xrefs: 0040B473
%M5DATE, xrefs: 0040B50F
%TO_HASH, xrefs: 0040B4B0
%TO_USER, xrefs: 0040B488
%FROM_EMAIL, xrefs: 0040B3E9
%FROM_USER, xrefs: 0040B431
%DATE, xrefs: 0040B4D2
%s@%s, xrefs: 0040B461
%TO_DOMAIN, xrefs: 0040B44B
%FROM_DOMAIN, xrefs: 0040B41E
%P5DATE, xrefs: 0040B4F2

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 07bf672bddbe06c2f420d96725ac0e1f54ef040b4224a6cef6ca6ba202742de3
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: 07bf672bddbe06c2f420d96725ac0e1f54ef040b4224a6cef6ca6ba202742de3
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 029B1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 029B202D
GetSystemInfo.KERNEL32(?), ref: 029B204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 029B206A
GetProcAddress.KERNEL32(00000000), ref: 029B2071
GetCurrentProcess.KERNEL32(?), ref: 029B2082
GetTickCount.KERNEL32 ref: 029B2230

Part of subcall function 029B1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 029B1E7C

Strings

work_srv, xrefs: 029B20C5
flags_upd, xrefs: 029B20A5, 029B20AA, 029B20E3
localcfg, xrefs: 029B2091, 029B2098, 029B20AB, 029B20E4, 029B20F3, 029B2119, 029B2138, 029B214E, 029B2166, 029B2183, 029B219B, 029B21B7, 029B21D7
hi_id, xrefs: 029B217D, 029B2182, 029B219A

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: ad89a558a526af43ddb215cb195e7ef56d43268a244c1e1827628b41dc779185
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 1E5137B0900348AFE332AF758D84FE7BAECEF85704F40491DF99692142D7B8A544CB65

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7686EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7686EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

net_type, xrefs: 004021DF
rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 66737db9b915561633ae3f492ee5f4d9e9eb10476a5fdfc482486e88eb260942
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: 66737db9b915561633ae3f492ee5f4d9e9eb10476a5fdfc482486e88eb260942
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: a4c47fe232f0f429a5e45ffdfbe97dd16a9fcdfbaa8a3ef520d6a4c94dc9225a
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: a4c47fe232f0f429a5e45ffdfbe97dd16a9fcdfbaa8a3ef520d6a4c94dc9225a
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 029B3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 029B3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 029B3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 029B3095
RtlAllocateHeap.NTDLL(00000000), ref: 029B30B6
htons.WS2_32(00000035), ref: 029B30EF
inet_addr.WS2_32(?), ref: 029B30FA
gethostbyname.WS2_32(?), ref: 029B310D
HeapFree.KERNEL32(00000000), ref: 029B314D

Strings

iphlpapi.dll, xrefs: 029B3062, 029B3067, 029B3077

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: a34baf1f08ff3a42c0dd7040d1b1c7549d64c0ca321ca18b9277bb9fac303ece
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: BF31B631A00206BBDB12DBB89D48BEE77BCEF05764F1441A5E918E7290DB74D541CB5C

Function 029B958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 029B95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 029B95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 029B95DC
wsprintfA.USER32 ref: 029B9635
wsprintfA.USER32 ref: 029B9673
wsprintfA.USER32 ref: 029B96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 029B9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 029B978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 029B97D8

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: b001f930b03aa73000ae96becf5d14f5538d158dcdeb970be76d510faaee7d44
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 16A16AB295020CAFEB22DFA0CD85FDA3BADEF48740F104026FA15A6151E7B5D584CFA4

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: eb7510e18f4f3ad5f9c27a48c5e533d648c270866267e0b44efdedb47f858b72
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: eb7510e18f4f3ad5f9c27a48c5e533d648c270866267e0b44efdedb47f858b72
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5de4b720525195bfa21f7211d5f61df3d951c59e2526b8a2204b20cbe9ca94a4
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5de4b720525195bfa21f7211d5f61df3d951c59e2526b8a2204b20cbe9ca94a4
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,771A8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 029B6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 029B67C3
htonl.WS2_32(?), ref: 029B67DF
htonl.WS2_32(?), ref: 029B67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 029B68F1
ExitProcess.KERNEL32 ref: 029B69BC

Strings

except_info, xrefs: 029B698F
localcfg, xrefs: 029B6994

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 252678702cf82b402801c59cd2f9c6b4ca81ac2595015a62932f1b0a42368217
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: B3616E71940208AFDF619FA4DC45FEA77E9FF48300F148066FA6DD2161DB75A9908F14

Function 029BF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(029BCC84), ref: 029BF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 029BF5CE
closesocket.WS2_32(00000000), ref: 029BF5DC

Strings

time_cfg, xrefs: 029BF58A

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: c36697e206fae3cdf7e980bad387d8d87737c7ecd7eaa711cf87e197ec3a304b
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 10318C7290011CABDB12DFB5DD88DEEBBBCEF88314F104566F905E3150E7708A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 029B2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 029B2FA1
LoadLibraryA.KERNEL32(?), ref: 029B2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 029B2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 029B3000
RtlAllocateHeap.NTDLL(00000000), ref: 029B3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 029B3032

Strings

dnsapi.dll, xrefs: 029B2F90

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 70892c50e9f0fef74d2f2dd83acb9e5615e6e99a6c72556d0a2db01196819b8f
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 8F21A171D01229BBCB22DF54DD88AEEBBBCEF08B50F004461F901E7540D7B49A8187E4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 029B99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 029B9A18
GetThreadContext.KERNEL32(?,?), ref: 029B9A52
TerminateProcess.KERNEL32(?,00000000), ref: 029B9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 029B9A98
SetThreadContext.KERNEL32(?,00010002), ref: 029B9AB5
ResumeThread.KERNEL32(?), ref: 029B9AC2

Strings

D, xrefs: 029B9A10

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 449f0eba3b288d6ad1fe802a7e411e42e269c3f35a46c60dd6b4c4e49e3e0bf3
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 1B213BB1A01219BBEB129BA1DD09EEFBBBCEF05750F404061BA19E5050E7759A84CFA4

Function 029B1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 029B1C18
LoadLibraryA.KERNEL32(004102C8), ref: 029B1C26
GetProcessHeap.KERNEL32 ref: 029B1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 029B1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 029B1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 029B1D02
FreeLibrary.KERNEL32(?), ref: 029B1D0B

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 93ec63b452a1e726b86677f70ec18d0d73d7beef71ff0b516573d3844ca42d18
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: C7315E31E00209BFCB129FE4DE988EEBBB9EF85705F24447AE509E2110D7B54E80DB94

Function 029B6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 029B6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 029B6D22
GetLastError.KERNEL32 ref: 029B6DA7
CloseHandle.KERNEL32(?), ref: 029B6DB5
GetLastError.KERNEL32 ref: 029B6DD6
DeleteFileA.KERNEL32(?), ref: 029B6DE7
GetLastError.KERNEL32 ref: 029B6DFD

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 8b323eb0eddfb865d11c9424e8aac627905ba7559ee8614626d6975b43b5d16d
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 5131E176900249BFCB02DFA4DE48ADE7F7DEF88310F148476E251E3250D770AA958B65

Function 029B6F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\fdcgtgix,029B7043), ref: 029B6F4E
GetProcAddress.KERNEL32(00000000), ref: 029B6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 029B6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 029B6F92

Strings

C:\Windows\SysWOW64\, xrefs: 029B6F30, 029B6F38, 029B6F65, 029B6F6C, 029B6F7A, 029B6F85, 029B6F91, 029B6FA9, 029B6FC6, 029B6FEC
\\.\pipe\fdcgtgix, xrefs: 029B6F37

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\fdcgtgix
API String ID: 1082366364-641816551
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 5b80198d06729259e56e476fa3693be4d4e72ab31c98098d4ae44dd958e85e30
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 8D2102227413447AF72353359E8CFFB3E4D8F92B24F1880A6F944E6490DBD994D682AD

Function 029BAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 029BAAE5

Strings

, xrefs: 029BABB3
localcfg, xrefs: 029BAD72

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: cfd63c9f51d115d1a3a7bdd0ca8150eef1c3339cb8dc1f674b8cd26bf15dc2df
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: FF713B71A00318BADF338B58DE85FEE376DAF81709F244467F904A6090DF7295C48B59

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 029BE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 029BDF6C: GetCurrentThreadId.KERNEL32 ref: 029BDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 029BE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,029B6128), ref: 029BE950
lstrcmp.KERNEL32(?,00000008), ref: 029BE989

Strings

A, xrefs: 029BE9A0
A, xrefs: 029BE960, 029BE965
A, xrefs: 029BE8C6, 029BE8CD, 029BE936, 029BE998

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: de33c884d5404985c5aea482ab15409ab6ba6d6156173993e0edb9d6f5071644
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 5831B231A007059BDF738F24C9847E67BECEF09715F80892AE5D687551D374E888CB91

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: bb3a68048dca612602b0c8d6e49c283fb6b7b0927c26922aed4f6a4c5afedb24
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: bb3a68048dca612602b0c8d6e49c283fb6b7b0927c26922aed4f6a4c5afedb24
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 029B6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 029B6E19

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 269d167a4fa46e2f1865d4837adcbfaaa042f403356f295e4d73e0c557cbf7ac
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 37212E7A104119BFDB129BB0FE48EDF7FADEF49665B108425F502D1090EB70EA509B74

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 029B92CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 029B92E2
wsprintfA.USER32 ref: 029B9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 029B9375
lstrlen.KERNEL32(?,?,00000000), ref: 029B9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 029B9394
CloseHandle.KERNEL32(00000000), ref: 029B939B

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: d971f06e0db10fb17e1b9cf8529f5022460c67be7a2fcb7cdf31ea2048674fb6
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: E81172B16401147BE7216B31ED0DFEF3A6EDFC9B10F008065BB09A5091EAB54E418A64

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,771B0F10,?,00000000,0040E538,?,771B0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 029BC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 029BC6B4
InterlockedIncrement.KERNEL32(029BC74B), ref: 029BC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,029BC747), ref: 029BC728
CloseHandle.KERNEL32(00000000,?,029BC747,00413588,029B8A77), ref: 029BC733

Strings

localcfg, xrefs: 029BC544

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: bec825192b39cae195558dc7e12f6a7e09e74ab2b81729216591cbf9874febf6
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: FE514AB1A01B468FD7258F69C6D466ABBE9FF88304B50593FE18BC7A90D774E840CB10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,771B0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe
API String ID: 124786226-577293463
Opcode ID: af514698247d92645eaa8a26d12ecf441a4c22af2d789d8c6bf78666e30c58a7
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: af514698247d92645eaa8a26d12ecf441a4c22af2d789d8c6bf78666e30c58a7
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 029B71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 029B71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029B7228
LocalFree.KERNEL32(?,?,?), ref: 029B7286
wsprintfA.USER32 ref: 029B729D

Strings

|, xrefs: 029B721A

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 464caa247c195e7534b5bb02cc54ca1f80958e5cce00a0371cebc8f276fa4088
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 9F312972A00208BFDB02DFA8DD45BDA7BACEF44314F14C166F959DB240EB75D6488BA4

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 029BB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 029BB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 029BB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 029BB548
GetTimeZoneInformation.KERNEL32(?), ref: 029BB590
wsprintfA.USER32 ref: 029BB61E

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 724ddb351160e7a98ca85c30cafe30d6e01b5a0d55529ddfa370c3705feaab14
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 5C511EB1D0021CAACF15DFD5D9889EEBBB9BF48304F10856AE505A6150E7F84AC9CF98

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 5dd434fdf3d1b2f7ac71eae5deaa1b81d7ffa9032da077e8e99a06cc7be058a2
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: 5dd434fdf3d1b2f7ac71eae5deaa1b81d7ffa9032da077e8e99a06cc7be058a2
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 029B62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 029B6303
LoadLibraryA.KERNEL32(?), ref: 029B632A
GetProcAddress.KERNEL32(00000000,?), ref: 029B63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 029B6405

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: aad41257da8cabcb71046fe7f354872aea0c2073ae96a8a25e94b59b3bd7ad9d
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 3B417971A00609ABDB16CF58CA84BEDBBBDFF04318F188469E969D7290E731F940CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(771B0F18,00000000,?,771B0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,771B0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,771B0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 029B93AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 029B93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 029B93CD
CharToOemA.USER32(?,?), ref: 029B93DB
wsprintfA.USER32 ref: 029B9410

Part of subcall function 029B92CB: GetTempPathA.KERNEL32(00000400,?), ref: 029B92E2
Part of subcall function 029B92CB: wsprintfA.USER32 ref: 029B9350
Part of subcall function 029B92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 029B9375
Part of subcall function 029B92CB: lstrlen.KERNEL32(?,?,00000000), ref: 029B9389
Part of subcall function 029B92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 029B9394
Part of subcall function 029B92CB: CloseHandle.KERNEL32(00000000), ref: 029B939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 029B9448

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: c6c1ec20cdbecd40651e6a05e1a5bec1c252ce1a6c8c2fe8c6c113f18cfb704d
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 33015EF69001187BEB21A7619E8DEDF3B7CDB95701F0040A2BB49E2080EAB497C58F75

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 53a70ba93e4b2c34d413b9add9e26c4f8e9f0de61643a904c0250f6f0d42246e
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: 53a70ba93e4b2c34d413b9add9e26c4f8e9f0de61643a904c0250f6f0d42246e
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 5c3f6046797f5d804895e4c05c4277987be728c98b5bed37973dbb72bca93dd1
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 5c3f6046797f5d804895e4c05c4277987be728c98b5bed37973dbb72bca93dd1
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 029B28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 029B28FA
gethostbyname.WS2_32(u6A), ref: 029B2906

Strings

u6A, xrefs: 029B28EC, 029B28F9, 029B2905
time_cfg, xrefs: 029B28EB

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: e12e3185b9d493d41d2444881e38ff6fe0016d23374082560665e496e5f71b62
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: DCE0C230A041119FCB018B2CF948AC537E8EF0A230F008580F844C31A0C734DCC09780

Function 029B69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 029B69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 029B6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 029B6A3A
CloseHandle.KERNEL32(000000FF), ref: 029B6BD8

Part of subcall function 029BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,029B1DCF,?), ref: 029BEEA8
Part of subcall function 029BEE95: HeapFree.KERNEL32(00000000), ref: 029BEEAF

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 37a56a69097bbaca44971f93b24aa9fc4b056b55e35b644095545d563b4f8c0d
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 1C71057190422DEFDF129FA4CD80AEEBBBDFF08354F10456AE515A6190D730AE92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 029BE2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,029BE50A,00000000,00000000,00000000,00020106,00000000,029BE50A,00000000,000000E4), ref: 029BE319
RegSetValueExA.ADVAPI32(029BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 029BE38E
RegDeleteValueA.ADVAPI32(029BE50A,?,?,?,?,?,000000C8,004122F8), ref: 029BE3BF
RegCloseKey.ADVAPI32(029BE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,029BE50A), ref: 029BE3C8

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 9d76c320faad90ea19956aa9fab8038ea3668973ae80c17f05a3b634b1221a7c
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: E3214A71A0021DBBDF229FA4ED89EEE7F7DEF08750F008021F944A6160E3718A54DBA0

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 029B41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 029B421F
GetLastError.KERNEL32 ref: 029B4229
WaitForSingleObject.KERNEL32(?,?), ref: 029B423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 029B424D

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 1583882053477f464152fbe648e7064e94fafd86c941f07aa2be2d7e6cc1a3b1
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: E801A572911109ABDF02DF90EE84BEE7BACEF08255F108461F901E6051D7709A54ABB6

Function 029B417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 029B41AB
GetLastError.KERNEL32 ref: 029B41B5
WaitForSingleObject.KERNEL32(?,?), ref: 029B41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 029B41D9

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 0bf8d5b814dfd0e2f984cb7a65127b0e70dc19d50f841843927de349a85ea806
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: A6010C7691110AAFDF02DF90EE84BEF7B6CEF18255F004061F905E2051D770DA549BB5

Function 029BE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 029BE066

Strings

A, xrefs: 029BE07F
A, xrefs: 029BE036
A, xrefs: 029BE037, 029BE03C

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 4c529f75edd2e8cfe3e5ce6fd2df7b88aaa4afb1ac67e450f00f64224b4967f4
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 5EF062312047069BCB22CF25D984AD2B7FDFF05325B84862AE595C3060D374A498CB55

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 029B8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 029B83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 029B8477

Part of subcall function 029B69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 029B69E5
Part of subcall function 029B69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 029B6A26
Part of subcall function 029B69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 029B6A3A

Part of subcall function 029BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,029B1DCF,?), ref: 029BEEA8
Part of subcall function 029BEE95: HeapFree.KERNEL32(00000000), ref: 029BEEAF

Strings

C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 029B848C, 029B84A1

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe
API String ID: 359188348-577293463
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 058d2e2d666173b218db3641edf9ac7209f9ca70d6ccf167a095350667d46fca
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 21417FB2901109BFEB12EBA09F84EFF776EFF48344F0444A6E508D6050E7B05A948B64

Function 029BAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 029BAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 029BB00D

Part of subcall function 029BAF6F: gethostname.WS2_32(?,00000080), ref: 029BAF83
Part of subcall function 029BAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 029BAFE6

Part of subcall function 029B331C: gethostname.WS2_32(?,00000080), ref: 029B333F
Part of subcall function 029B331C: gethostbyname.WS2_32(?), ref: 029B3349

Part of subcall function 029BAA0A: inet_ntoa.WS2_32(00000000), ref: 029BAA10

Strings

%OUTLOOK_BND_, xrefs: 029BB076, 029BB07B, 029BB0BE, 029BB0DD

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: be7d2e97a8a8cedca03450c7ab4067071aee5f4092de5c340df3a6be6ba360d5
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: C041317290020CABDB26EFA0DD45EEE3BADFF48304F144426F92992151EA75D654CF54

Function 029B9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 029B9536
Sleep.KERNEL32(000001F4), ref: 029B955D

Strings

, xrefs: 029B94D9

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 1cef30d1c57343924a909a52278edcb6d428be0b9a691c09745483575441051d
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 3F4125718583986EFB378B64DA8C7E63BAD9F02314F1400A5DA86871A2D7F44980CF11

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: addf51b803be8b3fdc0b349711ac0ded489e61cd96ba8191abdedb398079e53a
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: addf51b803be8b3fdc0b349711ac0ded489e61cd96ba8191abdedb398079e53a
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 029BBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 029BB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 029BBA3A
InterlockedIncrement.KERNEL32(?), ref: 029BBA94
GetTickCount.KERNEL32 ref: 029BBB79
GetTickCount.KERNEL32 ref: 029BBB99
InterlockedIncrement.KERNEL32(?), ref: 029BBE15
closesocket.WS2_32(00000000), ref: 029BBEB4

Strings

%FROM_EMAIL, xrefs: 029BBC7D

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 2d9468a872f1de813176799bfbeafec710fd1fcee8303e8f3e7621881576d352
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 07317C71500248DFDF26DFA4DE98BEDB7A9EF88704F20446AFA24821A0DB34D685CF50

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f585014306f6c3250efaa4e73719a74caf3cdfa730fd8078cc8a6a0845b45eb1
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f585014306f6c3250efaa4e73719a74caf3cdfa730fd8078cc8a6a0845b45eb1
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 07e354698f15fd9fc768e13d315d3543d6c442699b8c7836c4f7c54cdd5a5fd6
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: 07e354698f15fd9fc768e13d315d3543d6c442699b8c7836c4f7c54cdd5a5fd6
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 029B709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 029B70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 029B70F4

Strings

|, xrefs: 029B70E6

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 9175a348efa739e0004460cb552a100cf30286f3c4aaeb23d62e2edb7989c23b
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: E411FA73900118EBDB12CBD4DD84AEEB7BDAF44719F1442A6E501E6194D7709B88CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7686EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000014.00000002.1686797624.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 44b2ceadd519ca45f912a616d592807794313ca1f1de80b4bcf7ee55ccb8d493
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 44b2ceadd519ca45f912a616d592807794313ca1f1de80b4bcf7ee55ccb8d493
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 029B3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 029B2F88: GetModuleHandleA.KERNEL32(?), ref: 029B2FA1
Part of subcall function 029B2F88: LoadLibraryA.KERNEL32(?), ref: 029B2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 029B31DA
HeapFree.KERNEL32(00000000), ref: 029B31E1

Memory Dump Source

Source File: 00000014.00000002.1689159979.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_29b0000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 458f2a3c6801884b0a0f90d64a1ec5e32411f1e96aa837dc75be210740d6b19e
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: B7518A7190024AEFCB02DF64DD88AFAB779FF05304B1445A9EC9687220E7329A19CB94

Analysis Process: svchost.exePID: 2132, Parent PID: 7016COMMON

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1806
Total number of Limit Nodes:	18

Executed Functions

Function 0045C913 Relevance: 115.1, APIs: 45, Strings: 20, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0045CA4E
closesocket.WS2_32(?), ref: 0045CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0045CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0045CCB4
WriteFile.KERNEL32(0045A4B3,?,-000000E8,?,00000000), ref: 0045CCDC
CloseHandle.KERNEL32(0045A4B3), ref: 0045CCED
wsprintfA.USER32 ref: 0045CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0045CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0045CD89
CloseHandle.KERNEL32(?), ref: 0045CD98
CloseHandle.KERNEL32(?), ref: 0045CD9D
DeleteFileA.KERNEL32(?), ref: 0045CDC4
CloseHandle.KERNEL32(0045A4B3), ref: 0045CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0045CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0045CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0045D033
lstrcatA.KERNEL32(?,03900108), ref: 0045D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0045D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0045D171
WriteFile.KERNEL32(00000000,0390012C,?,?,00000000), ref: 0045D195
CloseHandle.KERNEL32(00000000), ref: 0045D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0045D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0045D231
lstrcatA.KERNEL32(?,03900108,?,?,?,?,?,?,?,00000100), ref: 0045D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0045D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0045D2C7
WriteFile.KERNEL32(00000000,0390012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0045D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0045D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0045D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0045D372
lstrcatA.KERNEL32(?,03900108,?,?,?,?,?,?,?,00000100), ref: 0045D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0045D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0045D408
WriteFile.KERNEL32(00000000,0390012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0045D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0045D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0045D45B
CreateProcessA.KERNEL32(?,00460264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0045D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0045D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0045D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0045D513
closesocket.WS2_32(?), ref: 0045D56C
Sleep.KERNEL32(000003E8), ref: 0045D577
ExitProcess.KERNEL32 ref: 0045D583
wsprintfA.USER32 ref: 0045D81F

Part of subcall function 0045C65C: send.WS2_32(00000000,?,00000000), ref: 0045C74B

closesocket.WS2_32(?), ref: 0045DAD5

Strings

time_cfg, xrefs: 0045C95B, 0045C962, 0045C971, 0045C984
except_info, xrefs: 0045D8CD, 0045D8D2, 0045D8FB
@, xrefs: 0045D754
wtm_c, xrefs: 0045C956
X F, xrefs: 0045C927, 0045C93C, 0045C9BE
lid_file_upd, xrefs: 0045CE6A
flags_upd, xrefs: 0045CE4A
localcfg, xrefs: 0045CA89, 0045CA93, 0045CAC0, 0045CAD2, 0045CE4F, 0045CE6F, 0045D8D3, 0045D8FC
\, xrefs: 0045D39D
local_time, xrefs: 0045CACD
work_srv, xrefs: 0045D607, 0045D60F, 0045D62C
\, xrefs: 0045D3A7
4, xrefs: 0045D9F7
srv_time, xrefs: 0045CABB
.dat, xrefs: 0045D0D7, 0045D138, 0045D1AE, 0045D1D4, 0045D28E, 0045D308, 0045D3CF, 0045D441
drivers\, xrefs: 0045D067
wtm_r, xrefs: 0045C97F
wtm_w, xrefs: 0045C96C
C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 0045CC10, 0045CCF3, 0045D975, 0045D98E
.sys, xrefs: 0045D0CC

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe$X F$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-1142629981
Opcode ID: ece61f69d1e51087402c0409c6020753906dfa92f92575cc06a7e4fb5c499431
Instruction ID: aaf224fff9ed8347996d404b0e437d7f9d0baeb3776143faa7984a1dc19ffc45
Opcode Fuzzy Hash: ece61f69d1e51087402c0409c6020753906dfa92f92575cc06a7e4fb5c499431
Instruction Fuzzy Hash: B0B2B771D00208BFEB249F65DD85FEF77B8AF05306F14006BF905A2292E7B85A49CB59

Function 00459A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00459A7F
SetErrorMode.KERNELBASE(00000003), ref: 00459A83
SetUnhandledExceptionFilter.KERNEL32(00456511), ref: 00459A8A

Part of subcall function 0045EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0045EC5E
Part of subcall function 0045EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0045EC72
Part of subcall function 0045EC54: GetTickCount.KERNEL32 ref: 0045EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00459AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00459ABA
GetCommandLineA.KERNEL32 ref: 00459AFD
lstrlenA.KERNEL32(?), ref: 00459B99
ExitProcess.KERNEL32 ref: 00459C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00459CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00459D7A
lstrcatA.KERNEL32(?,?), ref: 00459D8B
lstrcatA.KERNEL32(?,0046070C), ref: 00459D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00459DED
DeleteFileA.KERNEL32(00000022), ref: 00459E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00459E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00459EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00459ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00459F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00459F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00459F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00459FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00459FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00459FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0045A038
lstrcatA.KERNEL32(00000022,00460A34), ref: 0045A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0045A072
lstrcatA.KERNEL32(00000022,00460A34), ref: 0045A08D
wsprintfA.USER32 ref: 0045A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0045A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0045A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0045A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0045A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0045A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0045A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0045A1B6
GetCommandLineA.KERNEL32 ref: 0045A1E5

Part of subcall function 004599D2: lstrcpyA.KERNEL32(?,?,00000100,004622F8,00000000,?,00459E9D,?,00000022,?,?,?,?,?,?,?), ref: 004599DF
Part of subcall function 004599D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00459E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00459A3C
Part of subcall function 004599D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00459E9D,?,00000022,?,?,?), ref: 00459A52

lstrlenA.KERNEL32(?), ref: 0045A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0045A3B7
GetLastError.KERNEL32 ref: 0045A3ED
Sleep.KERNELBASE(000003E8), ref: 0045A400
DeleteFileA.KERNELBASE(004633D8), ref: 0045A407
CreateThread.KERNELBASE(00000000,00000000,0045405E,00000000,00000000,00000000), ref: 0045A42C
WSAStartup.WS2_32(00001010,?), ref: 0045A43A
CreateThread.KERNELBASE(00000000,00000000,0045877E,00000000,00000000,00000000), ref: 0045A469
Sleep.KERNELBASE(00000BB8), ref: 0045A48A
GetTickCount.KERNEL32 ref: 0045A49F
GetTickCount.KERNEL32 ref: 0045A4B7
Sleep.KERNELBASE(00001A90), ref: 0045A4C3

Strings

P, xrefs: 00459DAA
D, xrefs: 00459F8E
", xrefs: 0045A078
\, xrefs: 00459D0C
bzycpcet, xrefs: 0045A389, 0045A397
", xrefs: 0045A189
", xrefs: 00459EDB
C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 0045A1D9
%X%08X, xrefs: 0045A0B0

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe$D$P$\$bzycpcet
API String ID: 2089075347-3664033155
Opcode ID: 324d113e9e485487f1c928da26380612efba05300bf0c4dea372e089f1bd25b2
Instruction ID: 3f03944f31492c3d237d727120d70d8cbc3d9ccef1f93f1584638739de4cb108
Opcode Fuzzy Hash: 324d113e9e485487f1c928da26380612efba05300bf0c4dea372e089f1bd25b2
Instruction Fuzzy Hash: B052A3B1C00259EFDB11DFA19C49EEF77BCAB05305F1445ABF905E2142E6788E4C8B6A

Function 0045199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004519B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,00451E9E), ref: 004519BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004519E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004519ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004519F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,00451E9E), ref: 00451A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00451E9E), ref: 00451A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00451E9E), ref: 00451A36
GetAdaptersInfo.IPHLPAPI(00000000,00451E9E,?,?,?,?,00000001,00451E9E), ref: 00451A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,00451E9E,?,?,?,?,00000001,00451E9E), ref: 00451A5A
GetAdaptersInfo.IPHLPAPI(00000000,00451E9E,?,?,?,?,00000001,00451E9E), ref: 00451A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00451E9E), ref: 00451A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00451E9E), ref: 00451AA4

Strings

Iphlpapi.dll, xrefs: 004519B7
localcfg, xrefs: 004519A3
GetIfEntry, xrefs: 004519E4
GetBestInterface, xrefs: 004519EF
123.45.67.89, xrefs: 004519A6
GetAdaptersInfo, xrefs: 004519DC

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 31a502b617c0b22c36d1d947436e4a742c099566c27848aba66931257154c5c4
Instruction ID: 7ad9c6c5bb1f25826ce091520f4ad266b0c671c38fed23738475c2fb107434c6
Opcode Fuzzy Hash: 31a502b617c0b22c36d1d947436e4a742c099566c27848aba66931257154c5c4
Instruction Fuzzy Hash: 1F317272D01209AFCB129FE4CC88DBFBBB5EF45302B24057BE901A2221E7794E44CB59

Function 00457A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00457ABA
GetUserNameA.ADVAPI32(?,?), ref: 00457ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0046070C,?,?,?), ref: 00457B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00457B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00457B59
EqualSid.ADVAPI32(?,00000022), ref: 00457B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00457B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00457B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00457B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 00457BAB
LocalFree.KERNEL32(00000000), ref: 00457BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00457FC9,?,00000000), ref: 00457BCE

Strings

D, xrefs: 00457B0C
C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 00457CE2, 00457D0F, 00457D23, 00457D24

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe$D
API String ID: 2976863881-1834141438
Opcode ID: 7baa3c7a452d88eb32cf6d5a0be0a57ad3eed941c46f93c9db7dcbb3b5899ad1
Instruction ID: bb41ce7bb50e4843f4a79c70bfc20c1be9238aba881545f8816de156c7c37e75
Opcode Fuzzy Hash: 7baa3c7a452d88eb32cf6d5a0be0a57ad3eed941c46f93c9db7dcbb3b5899ad1
Instruction Fuzzy Hash: 5BA13D71904219AFDB118FA0EC84EEFBBB9FB44305F04407AE905E2251E7799A49CB69

Function 00457809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0045782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00457866
GetLengthSid.ADVAPI32(?), ref: 00457878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0045789A
GetSecurityDescriptorOwner.ADVAPI32(?,00457F63,?), ref: 004578B8
EqualSid.ADVAPI32(?,00457F63), ref: 004578D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004578E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004578F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00457901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00457910
LocalFree.KERNEL32(00000000), ref: 00457917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00457933
GetAce.ADVAPI32(?,00000000,?), ref: 00457963
EqualSid.ADVAPI32(?,00457F63), ref: 0045798A
DeleteAce.ADVAPI32(?,00000000), ref: 004579A3
EqualSid.ADVAPI32(?,00457F63), ref: 004579C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00457A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00457A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00457A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00457A79
LocalFree.KERNEL32(00000000), ref: 00457A87

Strings

D, xrefs: 0045785C

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 166537ff0becd92d7a3d3a4762ba4b155556d8306179a8aa77b3ed6029228073
Instruction ID: 43f6e77fe1fdb81ab94abe44280928d409599d3ee0ba066d17e2352fe6c7d50e
Opcode Fuzzy Hash: 166537ff0becd92d7a3d3a4762ba4b155556d8306179a8aa77b3ed6029228073
Instruction Fuzzy Hash: 2C815E71D0421AEBDB11CFA4ED44FEFBBB8AF08341F14407AE905E2251E7798A45CB69

Function 00458328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004583F3
RegQueryValueExA.KERNELBASE(00460750,?,00000000,?,00458893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00458414
RegSetValueExA.KERNELBASE(00460750,?,00000000,00000004,00458893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00458441
RegCloseKey.ADVAPI32(00460750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0045844A

Strings

localcfg, xrefs: 00458348
C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 004585C8, 004585D5, 004585E5

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe$localcfg
API String ID: 237177642-1129100248
Opcode ID: 96f26f018324a5b5ea42f16b31b4a6840a0577856e8897da1b3fc29f034c20c9
Instruction ID: 4f806e34c107089ce0cd57260e5ca00d488a5c3b5ab2189333fe4da9a6023fe8
Opcode Fuzzy Hash: 96f26f018324a5b5ea42f16b31b4a6840a0577856e8897da1b3fc29f034c20c9
Instruction Fuzzy Hash: E1C193B1940109BFEB11AB959D85EEF7B7CEB05306F14446BF901B2152FEB84E48CB29

Function 00451D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 00451DC6
GetSystemInfo.KERNELBASE(?), ref: 00451DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00451E03
GetProcAddress.KERNEL32(00000000), ref: 00451E0A
GetCurrentProcess.KERNEL32(?), ref: 00451E1B
GetTickCount.KERNEL32 ref: 00451FC9

Part of subcall function 00451BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00451C15

Strings

start_srv, xrefs: 00451E6C
localcfg, xrefs: 00451E2A, 00451E31, 00451E44, 00451E7D, 00451E8C, 00451EB2, 00451ED1, 00451EE7, 00451EFF, 00451F1C, 00451F34, 00451F50, 00451F70
kernel32, xrefs: 00451DF7
work_srv, xrefs: 00451E5E
IsWow64Process, xrefs: 00451DF2
net_type, xrefs: 00451E87
hi_id, xrefs: 00451F16, 00451F1B, 00451F33
loader_id, xrefs: 00451F4B, 00451F6B
lid_file_upd, xrefs: 00451E25
born_date, xrefs: 00451EAD, 00451ECC
flags_upd, xrefs: 00451E3E, 00451E43, 00451E7C

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 7d2faf28587f9f30c070b4c793a82ca0cbb343a1463f4b73ded6cf2bdedea479
Instruction ID: 7b424437ad2124be7f534a89c351bf6f22285636e179e1bfef13197bc60870c9
Opcode Fuzzy Hash: 7d2faf28587f9f30c070b4c793a82ca0cbb343a1463f4b73ded6cf2bdedea479
Instruction Fuzzy Hash: F151B7B19043446FE324AF768C86F277AECEB4470AF04091FFD5542253E7BDA948876A

Function 004573FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,771B0F10,00000000), ref: 00457472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,771B0F10,00000000), ref: 004574F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,771B0F10,00000000), ref: 00457528
___ascii_stricmp.LIBCMT ref: 0045764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,771B0F10,00000000), ref: 004576E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00457706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 00457717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,771B0F10,00000000), ref: 00457745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 004577EF

Part of subcall function 0045F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004622F8,000000C8,00457150,?), ref: 0045F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0045778F
RegCloseKey.KERNELBASE(?), ref: 004577E6

Strings

", xrefs: 00457599

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 21a2e00f68949eac384430ff74d3c61ab4b5b7ae087798d23ca7ae1d905a3c13
Instruction ID: 048ae9816a50cbcc691e63b8c97cfab5470b61eb4e0c6d2c5594b7bdd4ef8997
Opcode Fuzzy Hash: 21a2e00f68949eac384430ff74d3c61ab4b5b7ae087798d23ca7ae1d905a3c13
Instruction Fuzzy Hash: 0CC1E471904209BFDB119FA5EC45BEF7BB9EF05311F1000A7F904E6192EB789E488B69

Function 0045675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 0045677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 0045679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 004567B0
SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 004567BF
GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 004567D3
ReadFile.KERNELBASE(000000FF,?,00000040,00458244,00000000,?,771B0F10,00000000), ref: 00456807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0045681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 0045683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0045685C
ReadFile.KERNEL32(000000FF,?,00000028,00458244,00000000,?,771B0F10,00000000), ref: 0045688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,771B0F10,00000000), ref: 00456906
ReadFile.KERNEL32(000000FF,?,00000000,00458244,00000000,?,771B0F10,00000000), ref: 0045691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,771B0F10,00000000), ref: 00456971

Part of subcall function 0045EC2E: GetProcessHeap.KERNEL32(00000000,'E,00000000,0045EA27,00000000), ref: 0045EC41
Part of subcall function 0045EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0045EC48

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 2a8f8ff34d8257e275a79e55dc6faf835d653a02d5e1cddbfdf6604154b8d261
Instruction ID: ad0ca9f917dca6fe07a972417754b52569678cfa5a7fa9dab74174b9939a9d51
Opcode Fuzzy Hash: 2a8f8ff34d8257e275a79e55dc6faf835d653a02d5e1cddbfdf6604154b8d261
Instruction Fuzzy Hash: 627158B1C0021DEFDF109FA5CC80AEEBBB8FB04315F50456AE915A7291E7349E96CB64

Function 0045F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(0045CA1D), ref: 0045F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0045F367
closesocket.WS2_32(00000000), ref: 0045F375

Strings

time_cfg, xrefs: 0045F323

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 7433493a791b49217c385413c35b13fe56450017d95a82668ce8c97f473f2bf6
Instruction ID: bcec3266f758c084b813b6643224157acdb8f810a66357d5893e3722c6a52e73
Opcode Fuzzy Hash: 7433493a791b49217c385413c35b13fe56450017d95a82668ce8c97f473f2bf6
Instruction Fuzzy Hash: 9131AE72900118ABDB10DFA5DC89DEF7BBCEF89314F104176F905D3152E7748A498BAA

Function 0045405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00454070
ExitProcess.KERNEL32 ref: 00454121

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: dbd18c835606a211c7955312329d0f6eb7310fbb2f48f11ca70ffbed683f57f8
Instruction ID: d139cab7883ff7cbd679ab44a6cef566367a057fa66fe8c17d36745db16644a2
Opcode Fuzzy Hash: dbd18c835606a211c7955312329d0f6eb7310fbb2f48f11ca70ffbed683f57f8
Instruction Fuzzy Hash: 8E51B671D00118BADB209BA19C46FFF7A7CEB5075AF100066FE00A9182E7788E89C769

Function 00452D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,00452F01,?,004520FF,00462000), ref: 00452D3A
LoadLibraryA.KERNEL32(?), ref: 00452D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00452D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 00452D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00452D99
HeapAlloc.KERNEL32(00000000), ref: 00452DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00452DCB

Strings

dnsapi.dll, xrefs: 00452D29
DnsQuery_A, xrefs: 00452D5B

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: 73c29efe08fd9db4aa73cb9cec328e793d533a67f9c0f37199451c86bc64ed4a
Instruction ID: 4beb266edf8abb430aba619eedd2a89cc652ba4eee44f9816cdc14df1b08614b
Opcode Fuzzy Hash: 73c29efe08fd9db4aa73cb9cec328e793d533a67f9c0f37199451c86bc64ed4a
Instruction Fuzzy Hash: D7218171900226ABCB119F54DD449EFBBB8EF0A752F104023FD05E3211E3F4998987D9

Function 004580C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 0045815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0045A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 00458187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0045A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 004581BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 00458210

Part of subcall function 0045675C: SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 0045677E
Part of subcall function 0045675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 0045679A
Part of subcall function 0045675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 004567B0
Part of subcall function 0045675C: SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 004567BF
Part of subcall function 0045675C: GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 004567D3
Part of subcall function 0045675C: ReadFile.KERNELBASE(000000FF,?,00000040,00458244,00000000,?,771B0F10,00000000), ref: 00456807
Part of subcall function 0045675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0045681F
Part of subcall function 0045675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 0045683E
Part of subcall function 0045675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0045685C

Part of subcall function 0045EC2E: GetProcessHeap.KERNEL32(00000000,'E,00000000,0045EA27,00000000), ref: 0045EC41
Part of subcall function 0045EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0045EC48

Strings

C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe, xrefs: 00458225, 0045823A

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe
API String ID: 124786226-577293463
Opcode ID: c6e0686cea838e2e50318c82dc1167c01b1a6074544295137cd9d1a257921c59
Instruction ID: 4655488fb6f92ce43636e0611d9bb33c74d7ce5917bc22adf9b73f23f4e134ef
Opcode Fuzzy Hash: c6e0686cea838e2e50318c82dc1167c01b1a6074544295137cd9d1a257921c59
Instruction Fuzzy Hash: 4A41C4B1904509BFDB10EBA19D81DBF7B6C9B01305F1004BFF905E2142FEB85E488B2A

Function 00451AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00451AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00451AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00451B20

Strings

Iphlpapi.dll, xrefs: 00451ACC
GetAdaptersAddresses, xrefs: 00451AE3

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 4b27fb7cd242fc8721ad64152521b4f04ec3e99f068c6751478d6c318061b6c1
Instruction ID: d58a1c0b2f8b8cbdad9be44bec04ddfb7817c24b41a0c6d52b0786a99789d168
Opcode Fuzzy Hash: 4b27fb7cd242fc8721ad64152521b4f04ec3e99f068c6751478d6c318061b6c1
Instruction Fuzzy Hash: 95110A71E01124AFCB15DBA5CC84DEFBBB9EB44B12B244057E405A7222E6746E48CB88

Function 0045E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,0045E5F2,00000000,00020119,0045E5F2,004622F8), ref: 0045E3E6
RegQueryValueExA.ADVAPI32(0045E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0045E44E
RegQueryValueExA.ADVAPI32(0045E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0045E482
RegQueryValueExA.ADVAPI32(0045E5F2,?,00000000,?,80000001,?), ref: 0045E4CF
RegCloseKey.ADVAPI32(0045E5F2,?,?,?,?,000000C8,000000E4), ref: 0045E520

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: a7ef8f01a6569c54d92e2d429de33fa24434523b5d15da4f7a90ad51d46b9ffe
Instruction ID: 6d0e5307c8f516721f775e5adf668504028abc1d2b953c4160a37e0e6ad8e0a6
Opcode Fuzzy Hash: a7ef8f01a6569c54d92e2d429de33fa24434523b5d15da4f7a90ad51d46b9ffe
Instruction Fuzzy Hash: 0D4128B2D0021DBFDF119FD5DC81DEEBBB9EB04345F044066EA10A2252E3759F198B65

Function 0045F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0045F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0045F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0045F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0045F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0045F2FD

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 94868f68dead73769c7179e6617034427155ccf3e598d2f562528fed71c6e76a
Instruction ID: eb7e020830b10779ab4ddaea0e9d8fd408bfd8a746974b61e35589d19b1f85b8
Opcode Fuzzy Hash: 94868f68dead73769c7179e6617034427155ccf3e598d2f562528fed71c6e76a
Instruction Fuzzy Hash: 4411F8B2A40248BAEB11DF94CD85F9E7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00451BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00451AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00451AD4
Part of subcall function 00451AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00451AE9
Part of subcall function 00451AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00451B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00451C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00451C51

Strings

localcfg, xrefs: 00451BE7
hi_id, xrefs: 00451BE5

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 9c107f3e1f0db621dc9200b310d58acc7cef018d39da09f4d885b4253fbeedf1
Instruction ID: 55179416bede89a3039c1c9e181570ba68307c533c05cbe377c6193f7d44b09e
Opcode Fuzzy Hash: 9c107f3e1f0db621dc9200b310d58acc7cef018d39da09f4d885b4253fbeedf1
Instruction Fuzzy Hash: C9019672940118BFEB11DAF8CCC5AEFBBBCE744746F100476EA02E3211D2B49D488665

Function 00451B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00451AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00451AD4
Part of subcall function 00451AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00451AE9
Part of subcall function 00451AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00451B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00451BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,00451EFD,00000000,00000000,00000000,00000000), ref: 00451BB8

Strings

localcfg, xrefs: 00451B7B

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 90f8384f9c4fb814d6ef4ccbf3ad176897f8cfe3ba3775833383867050d4870b
Instruction ID: d399a4a3427fb1f89c5069825f42dd043560b6c8299babe7a124cd13c5a2252d
Opcode Fuzzy Hash: 90f8384f9c4fb814d6ef4ccbf3ad176897f8cfe3ba3775833383867050d4870b
Instruction Fuzzy Hash: 5D018BB2D00108BFEB019BE9CC81AEFFABCAB48655F150162AA01E3151E5B0AE0846A1

Function 00452684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000002), ref: 00452693
gethostbyname.WS2_32(00000002), ref: 0045269F

Strings

time_cfg, xrefs: 00452684

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: c977e37c101f63bf2c481d9bbab01b91473690c765c8ce71973e5c297d3f68cc
Instruction ID: cec561af5cab3a6c2ac47a0f59f81008c1282486e0dd7ea2372cbc428d2bf8c9
Opcode Fuzzy Hash: c977e37c101f63bf2c481d9bbab01b91473690c765c8ce71973e5c297d3f68cc
Instruction Fuzzy Hash: E7E08C302041218FCB108B28F848A8737E4AF06331F014182F840C32A1D7B4DC808689

Function 0045EC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0045EC0A,00000000,80000001,?,0045DB55,7FFF0001), ref: 0045EBAD
Part of subcall function 0045EBA0: HeapSize.KERNEL32(00000000,?,0045DB55,7FFF0001), ref: 0045EBB4

GetProcessHeap.KERNEL32(00000000,'E,00000000,0045EA27,00000000), ref: 0045EC41
RtlFreeHeap.NTDLL(00000000), ref: 0045EC48

Strings

'E, xrefs: 0045EC2F, 0045EC37, 0045EC3E

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID: 'E
API String ID: 1305341483-2717944224
Opcode ID: 2a5aff5f431b8d953d4b25f9e4e6df52600025519d6d6cb98a9b2aec4944cc38
Instruction ID: 2dc07175ac01d3909a92b820b6f77cc7029cb8bbeaf449d415ed157de3dcbaa8
Opcode Fuzzy Hash: 2a5aff5f431b8d953d4b25f9e4e6df52600025519d6d6cb98a9b2aec4944cc38
Instruction Fuzzy Hash: 4AC012324062306BC5552B51BD0DFDB7B189F47713F0D040AF8056615597A4994046EA

Function 0045E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0045DD05: GetTickCount.KERNEL32 ref: 0045DD0F
Part of subcall function 0045DD05: InterlockedExchange.KERNEL32(004636B4,00000001), ref: 0045DD44
Part of subcall function 0045DD05: GetCurrentThreadId.KERNEL32 ref: 0045DD53

GetFileSize.KERNEL32(00000000,00000000,?,771B0F10,?,00000000,?,0045A445), ref: 0045E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,771B0F10,?,00000000,?,0045A445), ref: 0045E583
CloseHandle.KERNEL32(00000000,?,771B0F10,?,00000000,?,0045A445), ref: 0045E5B2

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 7b9248ab86805dc1ef1754a050951aeaa9e37e285fc953d6a4393641c6745225
Instruction ID: bdf79045aba55851d0a700c16c5b168d92807f27db9e232731d19960b952c630
Opcode Fuzzy Hash: 7b9248ab86805dc1ef1754a050951aeaa9e37e285fc953d6a4393641c6745225
Instruction Fuzzy Hash: 3221F8B19403047AE1257A639C07F5B391CDF5575AF10002BFE09A11E3F99DDA1881FE

Function 0045877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 004588A5

Part of subcall function 0045F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0045E342,00000000,7686EA50,80000001,00000000,0045E513,?,00000000,00000000,?,000000E4), ref: 0045F089
Part of subcall function 0045F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0045E342,00000000,7686EA50,80000001,00000000,0045E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0045F093

Strings

localcfg, xrefs: 004587CA, 004587CF, 004587FB, 00458835, 00458861
rresolv, xrefs: 004587F6, 0045885C

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 56955fe4b8f7921c403b5cfe37f4e956ed5cf2ecb032962091623fa687e5c93a
Instruction ID: e9e8c90870aabebc454f51c3de5e4475acf0d94dc3ae421a7dee2298123f9738
Opcode Fuzzy Hash: 56955fe4b8f7921c403b5cfe37f4e956ed5cf2ecb032962091623fa687e5c93a
Instruction Fuzzy Hash: 8A2193315483007AF318B7666E4BF6A26A8DB05B5AFA4042FFD04A61C3FEDD554C81AF

Function 00454000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004622F8,004542B6,00000000,00000001,004622F8,00000000,?,004598FD), ref: 00454021
GetLastError.KERNEL32(?,004598FD,00000001,00000100,004622F8,0045A3C7), ref: 0045402C
Sleep.KERNEL32(000001F4,?,004598FD,00000001,00000100,004622F8,0045A3C7), ref: 00454046

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 133360e59f3c7bcedd3a6ec7d8f6b965be5cf49263426baee4767709900748bd
Instruction ID: 619079c5ce3407b9444882a6849ec9eec54f89ef15ff8dadd3daaed30c338fb1
Opcode Fuzzy Hash: 133360e59f3c7bcedd3a6ec7d8f6b965be5cf49263426baee4767709900748bd
Instruction Fuzzy Hash: FDF0A7312401016AD7350B24BC49BAB33A1DBC2B2AF354B26F7B5EA1E1C67448C99B1D

Function 0045DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0045DC19,?,00000104), ref: 0045DB7F
lstrcpyA.KERNEL32(?,004628F8), ref: 0045DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 0045DBC2

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: ba4b4e7f872305ea2799fcd7787a2e16644b07e5f3809c15c82e20c3089d2b99
Instruction ID: 2f568c3343a626d6db499979d1e2781317ba47398a89152adab438a528db624d
Opcode Fuzzy Hash: ba4b4e7f872305ea2799fcd7787a2e16644b07e5f3809c15c82e20c3089d2b99
Instruction Fuzzy Hash: E2F09070500209ABEF20DF64EC49FDA3B69AB10308F1045A4FB51A40E0E7F2E589CB19

Function 0045EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0045EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0045EC72
GetTickCount.KERNEL32 ref: 0045EC78

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: b143d6739c6d786fc971aa01d1634fa42cae31ab0fd21b39203fcd5e7d0d09c7
Instruction ID: b5ae04a05d3219104989919e0ccaf63441f54d75ef642fb26effd6ad11c56cfa
Opcode Fuzzy Hash: b143d6739c6d786fc971aa01d1634fa42cae31ab0fd21b39203fcd5e7d0d09c7
Instruction Fuzzy Hash: 2BE0BFF5810104BFEB11EBB0EC4EEBB77BCFB08315F500660F912D6090EAB09A048B65

Function 004530B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 004530D8
gethostbyname.WS2_32(?), ref: 004530E2

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: b3a0a6c2b2c066d0a227623f95f8794eae8f54002e61293d069e66dbb184ae21
Instruction ID: dc74a8eab7fccb8c1c1d7f280b4d08ca927940a60d1dea3f05c1caabafde072e
Opcode Fuzzy Hash: b3a0a6c2b2c066d0a227623f95f8794eae8f54002e61293d069e66dbb184ae21
Instruction Fuzzy Hash: 50E065719002199BCB009BA8EC8AF8B77ACBF04308F084461F905E3255FA74E9088794

Function 0045EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0045EBFE,7FFF0001,?,0045DB55,7FFF0001), ref: 0045EBD3
RtlAllocateHeap.NTDLL(00000000,?,0045DB55,7FFF0001), ref: 0045EBDA

Part of subcall function 0045EB74: GetProcessHeap.KERNEL32(00000000,00000000,0045EC28,00000000,?,0045DB55,7FFF0001), ref: 0045EB81
Part of subcall function 0045EB74: HeapSize.KERNEL32(00000000,?,0045DB55,7FFF0001), ref: 0045EB88

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: 164893fdfe7479852dfd1771787a9195fdd443b6d9dcc4020210626f957e10e1
Instruction ID: 8543aae5c5e8d674bad0d648166d6c37bead04fddb242bc03f4155c073930bcb
Opcode Fuzzy Hash: 164893fdfe7479852dfd1771787a9195fdd443b6d9dcc4020210626f957e10e1
Instruction Fuzzy Hash: 8DC08C322082206BCA0127A5BC0CEDB3E98EF0A3A3F080029FA09C2160DB75494087AB

Function 0045F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,0045CA44), ref: 0045F476

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 1c5ae62860c57b8096a2d1a5d5e44e5db2d1c6b37ed973135e01a81d4fe8dd81
Instruction ID: 5f926ef09f6a1a067283066da254864cd3b08861c65f6c30dd32549400494a9a
Opcode Fuzzy Hash: 1c5ae62860c57b8096a2d1a5d5e44e5db2d1c6b37ed973135e01a81d4fe8dd81
Instruction Fuzzy Hash: 82F08232201549AB9B019E5ADC84CAB3BADFB9A3117040132FE04D3111D631E8298765

Function 00451978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 00451992

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 6dc6fad8cb6eb2efcb59553a15ea4a45ab88191f48a249e62151e83ef84279a8
Instruction ID: 907dcc9cfdbf1bc8139f8f4df05e0c7cb6ac2c658e6745df05f7747c1e6ce22d
Opcode Fuzzy Hash: 6dc6fad8cb6eb2efcb59553a15ea4a45ab88191f48a249e62151e83ef84279a8
Instruction Fuzzy Hash: 0CD012661486316A52112759BC155BFAB9CDF45663B11842BFC48C0161D638CC45839A

Function 0045DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 0045DDB5

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 37060f13141977412198d774e8efcc6e5e5097efab89007002d140abec4e9435
Instruction ID: 1232fbc217db20898c6211901fd6466d87fd90e7ee995a3fd9c1d8904daeb5fc
Opcode Fuzzy Hash: 37060f13141977412198d774e8efcc6e5e5097efab89007002d140abec4e9435
Instruction Fuzzy Hash: 7BF05E32A00602DBCB308E249944657B3F4AF85327B14483BEA5592261E779DC4DCB16

Non-executed Functions

Function 0045637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00459816,EntryPoint), ref: 0045638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00459816,EntryPoint), ref: 004563A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004563CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004563EB

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 59f968a95f707829e03266f58ac56d2d4b4a876e5f324fbef5799f985bf8ac63
Instruction ID: 0099dfc5af788ef9aaa8b96b9c079489d1ea04ad4a6c391e86ba69ab3c8e0e6d
Opcode Fuzzy Hash: 59f968a95f707829e03266f58ac56d2d4b4a876e5f324fbef5799f985bf8ac63
Instruction Fuzzy Hash: AB11A3B2600219BFDB119F65DC49F9B3BA8EB057A9F114065FD08E7291E6B5DC008AA8

Function 00451000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00451839,00459646), ref: 00451012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004510C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004510E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00451101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00451121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00451140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00451160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00451180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0045119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004511BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004511DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004511FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0045121A

Strings

RtlInitUnicodeString, xrefs: 00451135
NtSetInformationThread, xrefs: 00451155
NtQueryInformationToken, xrefs: 00451262
NtFilterToken, xrefs: 0045122B
RtlLengthSid, xrefs: 00451246
RtlFreeSid, xrefs: 00451116
RtlNtStatusToDosError, xrefs: 00451194
NtDuplicateToken, xrefs: 004511F3
RtlSetLastWin32Error, xrefs: 004510D6
NtTerminateProcess, xrefs: 004510F6
RtlExpandEnvironmentStrings_U, xrefs: 004510BC
NtClose, xrefs: 004511B4
NtSetInformationToken, xrefs: 00451175
RtlAllocateAndInitializeSid, xrefs: 0045120F
ntdll.dll, xrefs: 0045100D
NtOpenProcessToken, xrefs: 004511D4

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: fbe981d26e56003fc34904dcb89135e60ce182b250b36f3eb73750bf12bc84e2
Instruction ID: 0e52f9f3f45c2b14af43f46a90398e8e466cc762398b3fa7fb35f097c6d38516
Opcode Fuzzy Hash: fbe981d26e56003fc34904dcb89135e60ce182b250b36f3eb73750bf12bc84e2
Instruction Fuzzy Hash: FE512FB1542681A6D7158F68AC80B5636A46749723F180377E920D22F2F7F8CA8DCF5F

Function 0045B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0045B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0045B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0045B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0045B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0045B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0045B329
wsprintfA.USER32 ref: 0045B3B7

Strings

Nov, xrefs: 0045B29C
Wed, xrefs: 0045B23A
Tue, xrefs: 0045B233
Jun, xrefs: 0045B279
Feb, xrefs: 0045B25D
May, xrefs: 0045B272
Dec, xrefs: 0045B2A3
Sat, xrefs: 0045B24F
Mon, xrefs: 0045B22C
Oct, xrefs: 0045B295
Jan, xrefs: 0045B256
Fri, xrefs: 0045B248
Aug, xrefs: 0045B287
Sun, xrefs: 0045B225
Mar, xrefs: 0045B264
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0045B3AF
Sep, xrefs: 0045B28E
Thu, xrefs: 0045B241
Apr, xrefs: 0045B26B
Jul, xrefs: 0045B280

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: f14d474c0bfc15d2fe91fb7b4ffc73ff3dddf35f8b0c4d1cd15f6c6037894bc8
Instruction ID: 5ffbae2012f4fedd80ac42d16ab710c29e8e8bd9cbfa0b5e9f8bc99318432294
Opcode Fuzzy Hash: f14d474c0bfc15d2fe91fb7b4ffc73ff3dddf35f8b0c4d1cd15f6c6037894bc8
Instruction Fuzzy Hash: FB512171D0021CAACF18DFD5D8498EFBBB9FF49305F10856AE901B6150E3B84A89CB99

Function 00456511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0045654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0045655C
htonl.WS2_32(?), ref: 00456578
htonl.WS2_32(?), ref: 00456587
wsprintfA.USER32 ref: 0045659B
wsprintfA.USER32 ref: 004565DC
wsprintfA.USER32 ref: 00456671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0045668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00456696
wsprintfA.USER32 ref: 004566B0
wsprintfA.USER32 ref: 004566E7
wsprintfA.USER32 ref: 004566FF
wsprintfA.USER32 ref: 0045671F
ExitProcess.KERNEL32 ref: 00456755

Strings

localcfg, xrefs: 0045672D
except_info, xrefs: 00456728
plgs:, xrefs: 004566AA
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0045666B
%d=%p, xrefs: 004566F9
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004565D6
va=%08X%08X uef=%p, xrefs: 00456595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00456547
Jan 13 2018, xrefs: 0045653A
12:08:32, xrefs: 00456535

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: aaaaf404c9d1f5d13f423a99772788b98ecee8ca4f05feefc7b3e1016b4281d3
Instruction ID: 95a1b0971c5b8ee57a30abe40787b6687f72c16296e77c1f592719d17e9d4ebd
Opcode Fuzzy Hash: aaaaf404c9d1f5d13f423a99772788b98ecee8ca4f05feefc7b3e1016b4281d3
Instruction Fuzzy Hash: 27617E72940208AFDB609FB4DC45FEA77E9FF08301F24406AF969D3162EA7599448F19

Function 0045A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0045A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0045A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0045A893
wsprintfA.USER32 ref: 0045A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0045A8D2
wsprintfA.USER32 ref: 0045A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0045A97C
wsprintfA.USER32 ref: 0045A9B9

Strings

data, xrefs: 0045A85E
AUTH LOGIN, xrefs: 0045A80C
ESMTP, xrefs: 0045AA38
ehlo %s, xrefs: 0045A7F5
rcpt to:<%s>, xrefs: 0045A855
Too big smtp respons (%d bytes), xrefs: 0045A9B1
helo %s, xrefs: 0045A803
localcfg, xrefs: 0045AB0B
Too small respons, xrefs: 0045A9C9
Incorrect respons, xrefs: 0045AB39
quit, xrefs: 0045A86C
Error sending command (sent = %d/%d), xrefs: 0045A8A7, 0045A8DA
., xrefs: 0045A8CA
mail from:<%s>, xrefs: 0045A848

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 232ada008a4bf5e112cc6630a7ce2409e928249193a0d3661bcc9d12cd8d0b05
Instruction ID: 59ab668eaf0636b758048e8fc998b1a8ae6a6a0af14eb60edb91fcfc66ff89d6
Opcode Fuzzy Hash: 232ada008a4bf5e112cc6630a7ce2409e928249193a0d3661bcc9d12cd8d0b05
Instruction Fuzzy Hash: C6A15A71900305ABDF209A54DC85FAF3769AB0030AF240627FE01A6193EA7DAD6DC75F

Function 00451280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0045139A
lstrlenW.KERNEL32(-00000003), ref: 00451571

Strings

D, xrefs: 004515C6
, xrefs: 00451462
uac, xrefs: 00451628
<, xrefs: 00451378
@, xrefs: 00451380
useless, xrefs: 0045161E
wusa.exe, xrefs: 00451388
%systemroot%\system32\cmd.exe, xrefs: 00451316

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 7ad915224aa6167c551c6f8de10de29c3ede77a2faffbb6de142901e3961534f
Instruction ID: 683d8944c4b737422eedc1fb653096b800b59fcc03761c4b8e54096a2beb882f
Opcode Fuzzy Hash: 7ad915224aa6167c551c6f8de10de29c3ede77a2faffbb6de142901e3961534f
Instruction Fuzzy Hash: B5F19FB55083419FD320DF64C888B6BB7E4FB88305F10492EF99697361E7B89948CF5A

Function 00452A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,771AF380), ref: 00452A83
HeapAlloc.KERNEL32(00000000,?,771AF380), ref: 00452A86
socket.WS2_32(00000002,00000002,00000011), ref: 00452AA0
htons.WS2_32(00000000), ref: 00452ADB
select.WS2_32 ref: 00452B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00452B4A
htons.WS2_32(?), ref: 00452B71
htons.WS2_32(?), ref: 00452B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00452BFB

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0f46c8fe5609ee764fc20de9ae4f72a63c7d71ca54746266a9b5c00642bcfb0d
Instruction ID: c525da74e067e8e8e7337ae5a50f6138be06168ac4dbc5ec47b1429e95efe41e
Opcode Fuzzy Hash: 0f46c8fe5609ee764fc20de9ae4f72a63c7d71ca54746266a9b5c00642bcfb0d
Instruction Fuzzy Hash: BB61E0719043059BC3219F51DE08B6FBBE8BB4A342F04081BFC4597253D7F8E8488BAA

Function 0045704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,771B0F10,?,771B0F10,00000000), ref: 004570C2
RegEnumValueA.ADVAPI32(771B0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,771B0F10,00000000), ref: 0045719E
RegCloseKey.ADVAPI32(771B0F10,?,771B0F10,00000000), ref: 004571B2
RegCloseKey.ADVAPI32(771B0F10), ref: 00457208
RegCloseKey.ADVAPI32(771B0F10), ref: 00457291
___ascii_stricmp.LIBCMT ref: 004572C2
RegCloseKey.ADVAPI32(771B0F10), ref: 004572D0
RegCloseKey.ADVAPI32(771B0F10), ref: 00457314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0045738D
RegCloseKey.ADVAPI32(771B0F10), ref: 004573D8

Part of subcall function 0045F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004622F8,000000C8,00457150,?), ref: 0045F1AD

Strings

, xrefs: 00457194
", xrefs: 00457227

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 5f293f5a3b5fe6d804c77c020548040f9ea60da7af8acd39d871a2e29bd0122e
Instruction ID: 7e5d09ebc545bbdcd1d14ef255debd576e2993abb63358bc0472aea30f7ecdb9
Opcode Fuzzy Hash: 5f293f5a3b5fe6d804c77c020548040f9ea60da7af8acd39d871a2e29bd0122e
Instruction Fuzzy Hash: D7B19672904209BEDB159FA1EC45BDF77B8AF04316F10047BFD01E2192EB799A48CB69

Function 0045AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0045AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0045ADA6

Part of subcall function 0045AD08: gethostname.WS2_32(?,00000080), ref: 0045AD1C
Part of subcall function 0045AD08: lstrlenA.KERNEL32(00000000), ref: 0045AD60
Part of subcall function 0045AD08: lstrlenA.KERNEL32(00000000), ref: 0045AD69
Part of subcall function 0045AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0045AD7F

Part of subcall function 004530B5: gethostname.WS2_32(?,00000080), ref: 004530D8
Part of subcall function 004530B5: gethostbyname.WS2_32(?), ref: 004530E2

wsprintfA.USER32 ref: 0045AEA5

Part of subcall function 0045A7A3: inet_ntoa.WS2_32(?), ref: 0045A7A9

wsprintfA.USER32 ref: 0045AE4F
wsprintfA.USER32 ref: 0045AE5E

Part of subcall function 0045EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0045EF92
Part of subcall function 0045EF7C: lstrlenA.KERNEL32(?), ref: 0045EF99
Part of subcall function 0045EF7C: lstrlenA.KERNEL32(00000000), ref: 0045EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0045AE9F
%OUTLOOK_BND_, xrefs: 0045AE0F, 0045AE14, 0045AE57, 0045AE76
%OUTLOOK_MID, xrefs: 0045AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0045AE49
%OUTLOOK_HST, xrefs: 0045AEC5
127.0.0.1, xrefs: 0045ADEB
%s%d, xrefs: 0045AE58

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: fa570846e3dcdf28709fa4dbaba3d310f49cc104538cbcb2c17a01eb5d10a733
Instruction ID: b81b335d9186296a43262bcb181e5ea39e43f1feddbbac3652c94398803fb5b6
Opcode Fuzzy Hash: fa570846e3dcdf28709fa4dbaba3d310f49cc104538cbcb2c17a01eb5d10a733
Instruction Fuzzy Hash: 1E4141B290020C6BDF25EFA1DC46EEF3BADFB08305F14442BFD1592152EA79E6188B55

Function 00452DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,771B23A0,?,000DBBA0,?,00000000,00452F0F,?,004520FF,00462000), ref: 00452E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00452F0F,?,004520FF,00462000), ref: 00452E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00452E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00452F0F,?,004520FF,00462000), ref: 00452E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00452F0F,?,004520FF,00462000), ref: 00452E4F
htons.WS2_32(00000035), ref: 00452E88
inet_addr.WS2_32(?), ref: 00452E93
gethostbyname.WS2_32(?), ref: 00452EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00452F0F,?,004520FF,00462000), ref: 00452EE3
HeapFree.KERNEL32(00000000,?,00000000,00452F0F,?,004520FF,00462000), ref: 00452EE6

Strings

iphlpapi.dll, xrefs: 00452DFB, 00452E00, 00452E10
GetNetworkParams, xrefs: 00452E28

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 8a594a112979816133b1e9cec1111d690f04b53e66bbdab5d80bde5cd59db0bf
Instruction ID: b1524ba4e31978ce2358e83697ae25037260c5a9cf66d5c9cb58dca3bbf314f6
Opcode Fuzzy Hash: 8a594a112979816133b1e9cec1111d690f04b53e66bbdab5d80bde5cd59db0bf
Instruction Fuzzy Hash: 9E31F631900209ABDB119BB89D4AAAF7778AF06322F140127FD14E3391EBB8DD458B5D

Function 00459326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00459DD7,?,00000022,?,?,00000000,00000001), ref: 00459340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00459DD7,?,00000022,?,?,00000000,00000001), ref: 0045936E
GetModuleFileNameA.KERNEL32(00000000,?,00459DD7,?,00000022,?,?,00000000,00000001), ref: 00459375
wsprintfA.USER32 ref: 004593CE
wsprintfA.USER32 ref: 0045940C
wsprintfA.USER32 ref: 0045948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004594F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00459526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00459571

Strings

runas, xrefs: 00459674

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 576d311e1d38b6f5088bee275991ce4e335cb5fabc2c906fc4ff811c4cb17379
Instruction ID: 292fb9d49636dfa2a24bb9adfe8ddee1fa25f60518dcfba805803f391ce3f947
Opcode Fuzzy Hash: 576d311e1d38b6f5088bee275991ce4e335cb5fabc2c906fc4ff811c4cb17379
Instruction Fuzzy Hash: 81A150B294060CFBEB259F91CD45FDF3BACEB05746F100027FE0592152E7B999488BA9

Function 00452011 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00452078
GetTickCount.KERNEL32 ref: 004520D4
GetTickCount.KERNEL32 ref: 004520DB
GetTickCount.KERNEL32 ref: 0045212B
GetTickCount.KERNEL32 ref: 00452132
GetTickCount.KERNEL32 ref: 00452142

Part of subcall function 0045F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0045E342,00000000,7686EA50,80000001,00000000,0045E513,?,00000000,00000000,?,000000E4), ref: 0045F089
Part of subcall function 0045F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0045E342,00000000,7686EA50,80000001,00000000,0045E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0045F093

Part of subcall function 0045E854: lstrcpyA.KERNEL32(00000001,?,?,0045D8DF,00000001,localcfg,except_info,00100000,00460264), ref: 0045E88B
Part of subcall function 0045E854: lstrlenA.KERNEL32(00000001,?,0045D8DF,00000001,localcfg,except_info,00100000,00460264), ref: 0045E899

Part of subcall function 00451C5F: wsprintfA.USER32 ref: 00451CE1

Strings

localcfg, xrefs: 00452070, 00452160, 00452186, 00452194, 004521E4
D-C, xrefs: 004520DD, 0045212D
net_type, xrefs: 004521DF
rbl_ip, xrefs: 0045218F
rbl_bl, xrefs: 00452181

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: D-C$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-2502931797
Opcode ID: 2e87a37ae9f414588edd0d1c85cab700b6cc904519663d809bf7f5957b9dda89
Instruction ID: b10b112ac3fbca6d6cefb97772cdc6c2c3abd4102bfa23d5ce5fe5878346ca0e
Opcode Fuzzy Hash: 2e87a37ae9f414588edd0d1c85cab700b6cc904519663d809bf7f5957b9dda89
Instruction Fuzzy Hash: 6051E130505B456ED728AF21EF55B573BD4AB02719F10007FEA41862E3EBF8998CCA1E

Function 0045B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0045B467

Part of subcall function 0045EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0045EF92
Part of subcall function 0045EF7C: lstrlenA.KERNEL32(?), ref: 0045EF99
Part of subcall function 0045EF7C: lstrlenA.KERNEL32(00000000), ref: 0045EFA0

Strings

%FROM_USER, xrefs: 0045B431
%TO_HASH, xrefs: 0045B4B0
%FROM_DOMAIN, xrefs: 0045B41E
%P5DATE, xrefs: 0045B4F2
%s@%s, xrefs: 0045B461
%M5DATE, xrefs: 0045B50F
%FROM_EMAIL, xrefs: 0045B3E9
%DATE, xrefs: 0045B4D2
%TO_EMAIL, xrefs: 0045B473
%TO_DOMAIN, xrefs: 0045B44B
%TO_USER, xrefs: 0045B488

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 77ace0a948fa1ea76f0d2b3f6e23bfbbafcfbf0871a7154dd9a5b4860cb51309
Instruction ID: e40ad48c29cdf60bad868e323b2b61bb81cc5822941d964eb786075dd6c77ba6
Opcode Fuzzy Hash: 77ace0a948fa1ea76f0d2b3f6e23bfbbafcfbf0871a7154dd9a5b4860cb51309
Instruction Fuzzy Hash: 474162B25401197EDF01AB96CCC2DFF7B6CEF4974DB14011AFD04A2142EB78AA1887B9

Function 0045C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0045A4C7: GetTickCount.KERNEL32 ref: 0045A4D1
Part of subcall function 0045A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0045A4FA

GetTickCount.KERNEL32 ref: 0045C31F
GetTickCount.KERNEL32 ref: 0045C32B
GetTickCount.KERNEL32 ref: 0045C363
GetTickCount.KERNEL32 ref: 0045C378
GetTickCount.KERNEL32 ref: 0045C44D
InterlockedIncrement.KERNEL32(0045C4E4), ref: 0045C4AE
CreateThread.KERNEL32(00000000,00000000,0045B535,00000000,?,0045C4E0), ref: 0045C4C1
CloseHandle.KERNEL32(00000000,?,0045C4E0,00463588,00458810), ref: 0045C4CC

Strings

localcfg, xrefs: 0045C2DD

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: ae2298583dca6172a5dbe93c2b9a706fa6abe563f7d0f6d86b603edbadb6d60a
Instruction ID: f67d95654b872eadc932ada97fba44e7b33ae0f5d3c3fb17cc27f73cb44fed57
Opcode Fuzzy Hash: ae2298583dca6172a5dbe93c2b9a706fa6abe563f7d0f6d86b603edbadb6d60a
Instruction Fuzzy Hash: E6519DB1500B448FC7248F69C5C452BBBE9FB49301B50593FD98BC7A91E778F8488B14

Function 0045BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0045BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0045BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0045BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0045BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0045BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0045BF94

Strings

smtp_herr, xrefs: 0045BE46, 0045BF62
smtp_retr, xrefs: 0045BE61, 0045BF8C
smtp_ban, xrefs: 0045BE55, 0045BF77

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 057ea858d3dd8b19e1dc48940da6addecc0fec35009b91c9fe036b58789e3fa5
Instruction ID: 3ba0c24274a5fbf563ec394b5567f2b64a74022d26ed8a86c82e5534c056d350
Opcode Fuzzy Hash: 057ea858d3dd8b19e1dc48940da6addecc0fec35009b91c9fe036b58789e3fa5
Instruction Fuzzy Hash: 75519032A0021AAFDB158F65CC41B5E7BA9EF04346F14406BEC41DB252E738EA49CFD9

Function 00456A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,771A8A60,?,?,?,?,00459A60,?,?,00459E9D), ref: 00456A7D
GetDiskFreeSpaceA.KERNEL32(00459E9D,00459A60,?,?,?,004622F8,?,?,?,00459A60,?,?,00459E9D), ref: 00456ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00459A60,?,?,00459E9D), ref: 00456B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00459A60,?,?,00459E9D), ref: 00456B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00459A60,?,?,00459E9D), ref: 00456B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00459A60,?,?,00459E9D), ref: 00456B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00459A60,?,?,00459E9D), ref: 00456B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00459A60,?,?,00459E9D), ref: 00456B80
GetLastError.KERNEL32(?,?,?,00459A60,?,?,00459E9D,?,?,?,?,?,00459E9D,?,00000022,?), ref: 00456B96

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 18f0ad2a595243c42a30c680b8588b3f7c9c49908947901c2020e5e4d90d16b9
Instruction ID: 46f7209a282575ff3b7cfbe7776659e7c810d09fa2c3d3b3460abbb1b5654a6a
Opcode Fuzzy Hash: 18f0ad2a595243c42a30c680b8588b3f7c9c49908947901c2020e5e4d90d16b9
Instruction Fuzzy Hash: 7F3126B290014CBFCB019FA09D44ADF7B78EF45301F154077EA51E3252E7B4A9498F6A

Function 00456F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0045D7C3), ref: 00456F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0045D7C3), ref: 00456FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00456FE8
LocalFree.KERNEL32(00000120), ref: 0045701F
wsprintfA.USER32 ref: 00457036

Strings

/%d, xrefs: 00457030
|, xrefs: 00456FB3

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 7e17ff93d473e1c7f12dd5900b0832f6fc21f23ef76e3f8e9b333b9cf3a6e0b9
Instruction ID: 29ffc896019a5c488a13712ec9e312993da8c231dde92de29af48a6d107b3aaf
Opcode Fuzzy Hash: 7e17ff93d473e1c7f12dd5900b0832f6fc21f23ef76e3f8e9b333b9cf3a6e0b9
Instruction Fuzzy Hash: 0C313C72904108BFDB01DFA5D849ADB7BBCEF04315F048066F949DB242EA79DA088B98

Function 00456CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004622F8,000000E4,00456DDC,000000C8), ref: 00456CE7
GetProcAddress.KERNEL32(00000000), ref: 00456CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00456D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00456D2B

Strings

kernel32, xrefs: 00456CE2
GetSystemWow64DirectoryA, xrefs: 00456CDD
C:\Windows\SysWOW64\, xrefs: 00456CC9, 00456CD1, 00456CFE, 00456D05, 00456D13, 00456D1E, 00456D2A, 00456D42, 00456D5F, 00456D85

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: a6720255fca6150eb9fb69ed00a51ee46ff59fa5b07c944254576dfe92a13c58
Instruction ID: 91a6e4de9ddb02d06ae5f1735c86df976c421b9055566cfd6765171499dc5196
Opcode Fuzzy Hash: a6720255fca6150eb9fb69ed00a51ee46ff59fa5b07c944254576dfe92a13c58
Instruction Fuzzy Hash: 9921265174164439F72657229C89F7B2E5C8B13746F09046BFC0497293FADE889D82AF

Function 0045977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00459947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004622F8), ref: 004597B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004622F8), ref: 004597EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004622F8), ref: 004597F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004622F8), ref: 00459831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004622F8), ref: 0045984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,004622F8), ref: 0045985B

Strings

D, xrefs: 004597A9

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 9012ac479da233c42b35aaa8e7879dad0b582e3cf9e150fe49ad6d229cdbdc31
Instruction ID: 2e53b746f5f16d510907a7612248e325c6d4aab66e1922ed785e9b49b64472fd
Opcode Fuzzy Hash: 9012ac479da233c42b35aaa8e7879dad0b582e3cf9e150fe49ad6d229cdbdc31
Instruction Fuzzy Hash: 3E218D71D11219FBDB119FA1DC49EEF7B7CEF09351F000062F908E1151EB759A48CAA9

Function 0045E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0045DD05: GetTickCount.KERNEL32 ref: 0045DD0F
Part of subcall function 0045DD05: InterlockedExchange.KERNEL32(004636B4,00000001), ref: 0045DD44
Part of subcall function 0045DD05: GetCurrentThreadId.KERNEL32 ref: 0045DD53

Part of subcall function 0045DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0045DDB5

lstrcpynA.KERNEL32(?,00451E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0045EAAA,?,?), ref: 0045E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0045EAAA,?,?,00000001,?,00451E84,?), ref: 0045E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0045EAAA,?,?,00000001,?,00451E84,?,0000000A), ref: 0045E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0045EAAA,?,?,00000001,?,00451E84,?), ref: 0045E94F

Strings

localcfg, xrefs: 0045E8AB
flags_upd, xrefs: 0045E8A7

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 3ea0dfab2cb606774bd1caff11ff5806666f703b765ca490461a31fc69cd95bd
Instruction ID: af492b2a776b8f5503b9c650c9eca4401c979a412645a8aacb8530f8915d929b
Opcode Fuzzy Hash: 3ea0dfab2cb606774bd1caff11ff5806666f703b765ca490461a31fc69cd95bd
Instruction Fuzzy Hash: 51514172D00209AFCB11DFA9C985DAEB7F9FF44309F14056EE805A3212E775EA18CB54

Function 00456BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00456BB2

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: d8e4d4b77f95a0594cfa208b8a8ce2d3029c39c90d3004482df1f10acb68f235
Instruction ID: 57c2449dfc3fddd3ec5ae574e852e38468c86a52466c4734aa088276e3f594d5
Opcode Fuzzy Hash: d8e4d4b77f95a0594cfa208b8a8ce2d3029c39c90d3004482df1f10acb68f235
Instruction Fuzzy Hash: AA21F372100105FFDB129B71FC49E9F3BACDB04366B214426F942E2092EB74DA08D67D

Function 00459064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004622F8), ref: 0045907B
wsprintfA.USER32 ref: 004590E9
CreateFileA.KERNEL32(004622F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0045910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00459122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0045912D
CloseHandle.KERNEL32(00000000), ref: 00459134

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 3ded0395f55181e2482a86db7aa26f8d8d4ee03cfe02b69376cf6384b7243203
Instruction ID: 620814d37df617deb2f6a1e4cbca2145696878fbe5c501fb86152fb8e8fb8728
Opcode Fuzzy Hash: 3ded0395f55181e2482a86db7aa26f8d8d4ee03cfe02b69376cf6384b7243203
Instruction Fuzzy Hash: 9111B7B26405147BF7256B23DC0AFAF366DDBC5705F00806AFB0AA1092FAB48E059669

Function 0045DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045DD0F
GetCurrentThreadId.KERNEL32 ref: 0045DD20
GetTickCount.KERNEL32 ref: 0045DD2E
Sleep.KERNEL32(00000000,?,771B0F10,?,00000000,0045E538,?,771B0F10,?,00000000,?,0045A445), ref: 0045DD3B
InterlockedExchange.KERNEL32(004636B4,00000001), ref: 0045DD44
GetCurrentThreadId.KERNEL32 ref: 0045DD53

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 470bcc5b15ef9539169baa48b7ee5edc75b84084112a3bba8b7a73a746541b4c
Instruction ID: b41d7d52adee7af0fb09b9096c761df8674d765ad5e2ba20c43df07140e4c156
Opcode Fuzzy Hash: 470bcc5b15ef9539169baa48b7ee5edc75b84084112a3bba8b7a73a746541b4c
Instruction Fuzzy Hash: 25F0BE72904205ABD7A05F65FC84B2A3BB4EB44313F000076EA0AC2262E7E9555D8E2F

Function 0045AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0045AD1C
lstrlenA.KERNEL32(00000000), ref: 0045AD60
lstrlenA.KERNEL32(00000000), ref: 0045AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0045AD7F

Strings

LocalHost, xrefs: 0045AD79

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: b09b091d8be495c66dd886dbe31372ecd520747283a8858173104601954fb644
Instruction ID: d247c8c1f9a889028dab893fa26d810880dc9bb2def042d61f631bc3fed984b2
Opcode Fuzzy Hash: b09b091d8be495c66dd886dbe31372ecd520747283a8858173104601954fb644
Instruction Fuzzy Hash: 570149208441895DDF3126289844BB77F775B9774BF100267DCC087613E6AC885F835F

Function 00454280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004598FD,00000001,00000100,004622F8,0045A3C7), ref: 00454290
CloseHandle.KERNEL32(0045A3C7), ref: 004543AB
CloseHandle.KERNEL32(00000001), ref: 004543AE

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 3d1785673b15d5ab18ff5d1bbdafaff51fd49b969dca51201bc0c18c7a3aa4d3
Instruction ID: e1c199d6270dbb0af57ae66aa461f2d6f5edb3a6e8acc8a5fc3fbb3bae38d81a
Opcode Fuzzy Hash: 3d1785673b15d5ab18ff5d1bbdafaff51fd49b969dca51201bc0c18c7a3aa4d3
Instruction Fuzzy Hash: 2F41C471D00109BADF109FA2CD46F9FBFB8EF4035AF100156F904A6192D7788A44DB65

Function 00456069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004564CF,00000000), ref: 0045609C
LoadLibraryA.KERNEL32(?,?,004564CF,00000000), ref: 004560C3
GetProcAddress.KERNEL32(?,00000014), ref: 0045614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0045619E

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 8069aa3dcb1719c2ae74518209c80c7474e339a87e8e317c617cbc531a78bca6
Instruction ID: bd6280be14f04b0ce19a2819da5a2eb24abeac2ebef1aa7423b4ed073bb7d8cc
Opcode Fuzzy Hash: 8069aa3dcb1719c2ae74518209c80c7474e339a87e8e317c617cbc531a78bca6
Instruction Fuzzy Hash: 0141BF71A00505AFDB24CF58C880BBAB7B8EF14356F65806AEC05D7392E738ED49CB84

Function 00452923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb87dba0453db0a18972efef385f02c9cba6291c624d522b153d847f457e210
Instruction ID: 7c4169744b4334e993870a23d11f0772031cac0ac1da4c1569a76197dc095db1
Opcode Fuzzy Hash: 3fb87dba0453db0a18972efef385f02c9cba6291c624d522b153d847f457e210
Instruction Fuzzy Hash: 1831B571A00309ABCF109FA6CD826BEB7F4FF49706F10445BF905E6242E3B8DA458B58

Function 004526FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045272E
htons.WS2_32(00000001), ref: 00452752
htons.WS2_32(0000000F), ref: 004527D5
htons.WS2_32(00000001), ref: 004527E3
sendto.WS2_32(?,00462BF8,00000009,00000000,00000010,00000010), ref: 00452802

Part of subcall function 0045EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0045EBFE,7FFF0001,?,0045DB55,7FFF0001), ref: 0045EBD3
Part of subcall function 0045EBCC: RtlAllocateHeap.NTDLL(00000000,?,0045DB55,7FFF0001), ref: 0045EBDA

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 46d5cf4d3df9056393a440aa11b025c91596792ea3f20635319ecc308f764f71
Instruction ID: e0fd3a5bc0b0b75f2d40a490c9a20bdf4e283333186239924c1eb119e3cbb9df
Opcode Fuzzy Hash: 46d5cf4d3df9056393a440aa11b025c91596792ea3f20635319ecc308f764f71
Instruction Fuzzy Hash: 6E313534240382AFD710CF76DC90A667760FF1E758B19406EE8558B323E2F2E846C70A

Function 00459145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004622F8), ref: 0045915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00459166
CharToOemA.USER32(?,?), ref: 00459174
wsprintfA.USER32 ref: 004591A9

Part of subcall function 00459064: GetTempPathA.KERNEL32(00000400,?,00000000,004622F8), ref: 0045907B
Part of subcall function 00459064: wsprintfA.USER32 ref: 004590E9
Part of subcall function 00459064: CreateFileA.KERNEL32(004622F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0045910E
Part of subcall function 00459064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00459122
Part of subcall function 00459064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0045912D
Part of subcall function 00459064: CloseHandle.KERNEL32(00000000), ref: 00459134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004591E1

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 6bf829490e96da07ce3780ca48a050a7bc908b62bb7d96f713636faba154e889
Instruction ID: 4b1afcc6a20420d803622d9a5ebcd8f46ccf668594bd7e45c92ed0078db59efe
Opcode Fuzzy Hash: 6bf829490e96da07ce3780ca48a050a7bc908b62bb7d96f713636faba154e889
Instruction Fuzzy Hash: 600184F68001187BD72097519D49EDF367CDB85701F0000A6FB05E1081EAF49A888F75

Function 00452419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00452491,?,?,?,0045E844,-00000030,?,?,?,00000001), ref: 00452429
lstrlenA.KERNEL32(?,?,00452491,?,?,?,0045E844,-00000030,?,?,?,00000001,00451E3D,00000001,localcfg,lid_file_upd), ref: 0045243E
lstrcmpiA.KERNEL32(?,?), ref: 00452452
lstrlenA.KERNEL32(?,?,00452491,?,?,?,0045E844,-00000030,?,?,?,00000001,00451E3D,00000001,localcfg,lid_file_upd), ref: 00452467

Strings

localcfg, xrefs: 0045241F

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 07bd2db06cd662c78bf35709a15cb967613a7ccf47378211ee7b364db2000a74
Instruction ID: 08bec74ecc916698921a1d57a82e32772f22e32380b836fc365d72d7b7d96795
Opcode Fuzzy Hash: 07bd2db06cd662c78bf35709a15cb967613a7ccf47378211ee7b364db2000a74
Instruction Fuzzy Hash: 70011A31600218AF8F11EF69DD808DE7BA9EF46355B05C427EC5997212E3B4EA45CA98

Function 00456EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00456F0F
CheckTokenMembership.ADVAPI32(00000000,?,*pE), ref: 00456F24
FreeSid.ADVAPI32(?), ref: 00456F3E

Strings

*pE, xrefs: 00456F1C, 00456F1F

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *pE
API String ID: 3429775523-3809662669
Opcode ID: 2dfce98a000d712d5b0fee9ce9ff89771d626c52ad4201a9335a9939ec327ff9
Instruction ID: 73d14cbca183cbfc413657e2220855adc9e7a2b73d1d4721b727856710003cad
Opcode Fuzzy Hash: 2dfce98a000d712d5b0fee9ce9ff89771d626c52ad4201a9335a9939ec327ff9
Instruction Fuzzy Hash: 40015E72A01608FFDB10DFE4ED85AAE77B8EB04305F50487AE605E2152E3B49948CA59

Function 00451C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00451CE1
wsprintfA.USER32 ref: 00451D6B

Strings

localcfg, xrefs: 00451C70
%u.%u.%u.%u.%s, xrefs: 00451CDB, 00451D65

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: f1e335131c7c5f80ccd0b54e921f06a3bb59eb11f560458ec446b87f1ea314ce
Instruction ID: f93e04fefba7c0e0a1843121bd5f3f4bc49d5298de209c694cd76d3d8c3b1e7b
Opcode Fuzzy Hash: f1e335131c7c5f80ccd0b54e921f06a3bb59eb11f560458ec446b87f1ea314ce
Instruction Fuzzy Hash: D941CF729042989FDB21CF798D44BEE3BF89F49311F240056FD64D3252E639EA09CBA4

Function 0045E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0045DD05: GetTickCount.KERNEL32 ref: 0045DD0F
Part of subcall function 0045DD05: InterlockedExchange.KERNEL32(004636B4,00000001), ref: 0045DD44
Part of subcall function 0045DD05: GetCurrentThreadId.KERNEL32 ref: 0045DD53

lstrcmpA.KERNEL32(771B0F18,00000000,?,771B0F10,00000000,?,00455EC1), ref: 0045E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,771B0F10,00000000,?,00455EC1), ref: 0045E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,771B0F10,00000000,?,00455EC1), ref: 0045E722

Strings

89ABCDEF, xrefs: 0045E721

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 96a9740e7ae3894101740544e701bf736c338a8d7778cfa31937a0a59413f2fd
Instruction ID: b91ae743c2297c34fdb9bbc3bc9db0d78eebb4160227d90aeb762fe57a4bdc2c
Opcode Fuzzy Hash: 96a9740e7ae3894101740544e701bf736c338a8d7778cfa31937a0a59413f2fd
Instruction Fuzzy Hash: 0731D231500701DBCB398F62D88476777E4AF25396F10442FE99587652E7B8EA88CB4A

Function 0045E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0045E2A3,00000000,00000000,00000000,00020106,00000000,0045E2A3,00000000,000000E4), ref: 0045E0B2
RegSetValueExA.ADVAPI32(0045E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004622F8), ref: 0045E127
RegDeleteValueA.ADVAPI32(0045E2A3,?,?,?,?,?,000000C8,004622F8), ref: 0045E158
RegCloseKey.ADVAPI32(0045E2A3,?,?,?,?,000000C8,004622F8,?,?,?,?,?,?,?,?,0045E2A3), ref: 0045E161

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 3a293b77e157feab516fe1e4000e31eb40dc59e5b4a1a49cf50e0f9148f1b6a0
Instruction ID: 956d8b59245814aa0126eb58baef1cfbb41ce04340209aaffc9adb9503f0d3b0
Opcode Fuzzy Hash: 3a293b77e157feab516fe1e4000e31eb40dc59e5b4a1a49cf50e0f9148f1b6a0
Instruction Fuzzy Hash: 3F215071A00229BBDF209FA6DC89EDF7F79EF09754F004062FD04A6151E6718B18DB95

Function 00453F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0045A3C7,00000000,00000000,000007D0,00000001), ref: 00453F44
GetLastError.KERNEL32 ref: 00453F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00453F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453F72

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 7fa5c0b799b387b89d23fd9be310602f9cc47103cf8d6f0186ae8f797e03e4fc
Instruction ID: a06f641612f21be91a38e96e8c44ac1d2157e402325100c0f5b8d43abeb3aed0
Opcode Fuzzy Hash: 7fa5c0b799b387b89d23fd9be310602f9cc47103cf8d6f0186ae8f797e03e4fc
Instruction Fuzzy Hash: EB010C72915109ABDF01DF90ED44BEF7B7CEB04396F104026FA01E2151E774DA158BB6

Function 00453F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0045A3C7,00000000,00000000,000007D0,00000001), ref: 00453FB8
GetLastError.KERNEL32 ref: 00453FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00453FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453FE6

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 0731c7a1bddd687a8a6e799b7a09a5a15634b71c94fa9bcc50f1849c560fa8e8
Instruction ID: 62c4be2f6fb6c9490d700730fe7191ce812da41a7be2ce8957ff7d943743218a
Opcode Fuzzy Hash: 0731c7a1bddd687a8a6e799b7a09a5a15634b71c94fa9bcc50f1849c560fa8e8
Instruction Fuzzy Hash: 8801177291110AABDF01DF90ED45BEF3B7CEB04356F004022FD02E2050E7749A148BB6

Function 0045A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045A4D1
GetTickCount.KERNEL32 ref: 0045A4E4
Sleep.KERNEL32(00000000,?,0045C2E9,0045C4E0,00000000,localcfg,?,0045C4E0,00463588,00458810), ref: 0045A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0045A4FA

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 12d4890236749a5e392ce50f15df743a1457186524b5503b200b96a2dcff33c9
Instruction ID: 25fdee8d33b1cba829ee0fd9ed546dd45dee5a68954a6aba2fc678be6d87d62b
Opcode Fuzzy Hash: 12d4890236749a5e392ce50f15df743a1457186524b5503b200b96a2dcff33c9
Instruction Fuzzy Hash: 50E0263320020467C6001BE5BD84F6B3388AB4A762F010132FF04D3242E69AA85541BF

Function 00454E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00454E9E
GetTickCount.KERNEL32 ref: 00454EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00454EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00454EC3

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 007bfad4e3c165b09952189f77988571a652048760c0c2e15fcb65dac501d158
Instruction ID: 1cee8403b9d03df5432fb1acea8772955b59a23de8c1a5281a98b359c9b60576
Opcode Fuzzy Hash: 007bfad4e3c165b09952189f77988571a652048760c0c2e15fcb65dac501d158
Instruction Fuzzy Hash: B6E0263220020427D60023BABC84F576289AB86366F010532EB08C6181D69A988205BA

Function 00454BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00454BDD
GetTickCount.KERNEL32 ref: 00454BEC
Sleep.KERNEL32(00000000,?,?,?,02A1E084,004550F2), ref: 00454BF9
InterlockedExchange.KERNEL32(02A1E078,00000001), ref: 00454C02

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: e3871878ce8858f21c807fa7c4991cbee0514a9797fb3e763a031bd5a69b8381
Instruction ID: 65f86059779b8aa9be0a84bc2326954b6126174702fa42148c1b6562369d18b2
Opcode Fuzzy Hash: e3871878ce8858f21c807fa7c4991cbee0514a9797fb3e763a031bd5a69b8381
Instruction Fuzzy Hash: E7E0863224521467C61017A56D80F5B77989BD5366F060473FB08D6151D59AE48541BA

Function 004530FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00453103
GetTickCount.KERNEL32 ref: 0045310F
Sleep.KERNEL32(00000000), ref: 0045311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00453128

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: f8be4a66bf55b6f6a761d4502aefb66559227bd940067035c063295a73b1644e
Instruction ID: c2612821dd07afb844c4f8cc04d0ead2f987a4287ebc2f377ea2408c0db2bf63
Opcode Fuzzy Hash: f8be4a66bf55b6f6a761d4502aefb66559227bd940067035c063295a73b1644e
Instruction Fuzzy Hash: 1EE0C231200215ABDB006F76BD44B4F6A9ADF847A3F010432FA01D61A1D6944D05897B

Function 00456987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00459A60,?,?,00000000,00000000,00459A60,?,00000000), ref: 004569F9
WriteFile.KERNEL32(00459A60,?,00459A60,00000000,00000000), ref: 00456A27

Strings

,kE, xrefs: 004569A7, 004569D5

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,kE
API String ID: 3934441357-1319723493
Opcode ID: ebbaf7e2b0a8d3d6dad23903e5861fc78b68b42c33d9d1a56293342ccf7d0e3c
Instruction ID: cfe7e3c84b58f820c6ac756347d37c85462845e79f8c2349659edf58e5e68f03
Opcode Fuzzy Hash: ebbaf7e2b0a8d3d6dad23903e5861fc78b68b42c33d9d1a56293342ccf7d0e3c
Instruction Fuzzy Hash: 2F314B72A00209EFDB24CF58DD84BAA77F4EB14316F51846AEC01E7201D374EE58CB65

Function 00458CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00458D02
GetTickCount.KERNEL32 ref: 00458DA1

Strings

localcfg, xrefs: 00458D19

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: bcaed46bd1c1f7c24044b5ddf3b20c3714f8e0de5a6b5af41dc6c815d558dc66
Instruction ID: 7f692a4f52ed16448b070c683ddb9fda955a20d7306c03cf61701311fd87528d
Opcode Fuzzy Hash: bcaed46bd1c1f7c24044b5ddf3b20c3714f8e0de5a6b5af41dc6c815d558dc66
Instruction Fuzzy Hash: 7121AE32610115AFDB109F64D88166ABBF9AB20312B29006FDC01E7293DF78E94C875A

Function 0045BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045BFD0
wsprintfA.USER32 ref: 0045C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0045C057

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: a1c97c65fbe8c6f0bc5d31b6067bce2c1736d43a09fe49bbee67d1ff85d0d4bb
Instruction ID: dee9b98d87c03c3a49f5fe96d6f639b7c4f84cc32a01cce6e6eacb9e356ecfe3
Opcode Fuzzy Hash: a1c97c65fbe8c6f0bc5d31b6067bce2c1736d43a09fe49bbee67d1ff85d0d4bb
Instruction Fuzzy Hash: 10119772100100FFDB429BA9DD44E567FA6FF88318B3491ACF6188E166D633D863EB50

Function 004538F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004530FA: GetTickCount.KERNEL32 ref: 00453103
Part of subcall function 004530FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00453128

GetCurrentThreadId.KERNEL32 ref: 00453929
GetCurrentThreadId.KERNEL32 ref: 00453939

Strings

%FROM_EMAIL, xrefs: 00453913

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 8ef935f39c53b90dc290e51200adecef8c904de422cbdc9af52d558b1a6a5542
Instruction ID: c23d2aaac41f9bdc56065093316df8c61fb46fdb9ad20269ea80c3c2d8d29b34
Opcode Fuzzy Hash: 8ef935f39c53b90dc290e51200adecef8c904de422cbdc9af52d558b1a6a5542
Instruction Fuzzy Hash: 161158B1900215EFD720DF0AD581A5DF3F4FB05757F10852EE84097292D7B8AA88CFA9

Function 0045AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0045BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0045ABB9
InterlockedIncrement.KERNEL32(00463640), ref: 0045ABE1

Strings

%FROM_EMAIL, xrefs: 0045AB8C

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 99eb4968e01bae0413f774fe324885d7979eb5a6efba502aa5b67b1734a9c8d6
Instruction ID: d7bb0d4b177be1ad4ba0e6849e01259bb65fcdd5b538b1279a96c654a3f36315
Opcode Fuzzy Hash: 99eb4968e01bae0413f774fe324885d7979eb5a6efba502aa5b67b1734a9c8d6
Instruction Fuzzy Hash: 5801F1315083C4AFDB21CF18D881F867BA6AF15315F144586FA808B303C3B9EA58CBD6

Function 004526B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004526C3
inet_ntoa.WS2_32(?), ref: 004526E4

Strings

localcfg, xrefs: 004526CD, 004526D2, 004526DE

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 79656c7ed79c53b518bd87b79d6b921bde2c6ecfb40bcc3d3710413b0d0924d8
Instruction ID: 923ca10ac179065bdd36e2e22d40fb2e05b91002513aabd7366431c1f3223ea3
Opcode Fuzzy Hash: 79656c7ed79c53b518bd87b79d6b921bde2c6ecfb40bcc3d3710413b0d0924d8
Instruction Fuzzy Hash: 8BF082321482097FEB04AFA1ED09A9B379CEF05751F104467FE08CA091EBB5D944979D

Function 0045EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0045EB54,_alldiv,0045F0B7,80000001,00000000,00989680,00000000,?,?,?,0045E342,00000000,7686EA50,80000001,00000000), ref: 0045EAF2
GetProcAddress.KERNEL32(776F0000,00000000), ref: 0045EB07

Strings

ntdll.dll, xrefs: 0045EAED

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: e1227c046a191a5b7c39a87e2427aa2bf0d04f57205a7f60711f984045e9a122
Instruction ID: 5372a8a08bed4c02eb53afac7823b29f9d98728b0306ad8f648b08dd30d5ca92
Opcode Fuzzy Hash: e1227c046a191a5b7c39a87e2427aa2bf0d04f57205a7f60711f984045e9a122
Instruction Fuzzy Hash: D4D0C7346003426B8F25CF65DE0A94776996750703B404026F806C1621F7F4E548D60E

Function 00452F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00452D21: GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,00452F01,?,004520FF,00462000), ref: 00452D3A
Part of subcall function 00452D21: LoadLibraryA.KERNEL32(?), ref: 00452D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00452F73
HeapFree.KERNEL32(00000000), ref: 00452F7A

Memory Dump Source

Source File: 00000018.00000002.3691471117.0000000000450000.00000040.00000400.00020000.00000000.sdmp, Offset: 00450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_450000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: f8d6d7cad6c1189b0a86d2bd88554609ba148a2ea7db1932527e64493523d0f1
Instruction ID: fb5f3c1885d13adc67b0d4adfcebb5edfec967f11c72bb50e6285e35069514cf
Opcode Fuzzy Hash: f8d6d7cad6c1189b0a86d2bd88554609ba148a2ea7db1932527e64493523d0f1
Instruction Fuzzy Hash: A251E2319002069FCF01DF64DC889FAB774FF16306F10416AEC96C7211E7769A19CB88

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vyrcclmm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.e323dacc-2647-4ccd-8b7c-976c876a1a2b.1.etl

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

C:\Users\user\AppData\Local\Temp\pspizbvl.exe

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

C:\Windows\SysWOW64\bzycpcet\pspizbvl.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
vyrcclmm.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre