Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe
Analysis ID:	1469237
MD5:	56781772c92e1822beec9faee18fadc9
SHA1:	889af8e28ecda1df1e79c1f4abe533959b29a9db
SHA256:	4f0a6b89e63437c52a7adf09a15950b3ba5b9d1d7c8791a8559721ae24875894
Tags:	exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Modifies existing windows services

One or more processes crash

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe (PID: 572 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe" MD5: 56781772C92E1822BEEC9FAEE18FADC9)

cmd.exe (PID: 7148 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jcbeaetw\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2108 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\szylttbf.exe" C:\Windows\SysWOW64\jcbeaetw\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5260 cmdline: "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2260 cmdline: "C:\Windows\System32\sc.exe" description jcbeaetw "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 2604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2956 cmdline: "C:\Windows\System32\sc.exe" start jcbeaetw MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1576 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6056 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 1032 MD5: C31336C1EFC2CCB44B4326EA793040F2)

szylttbf.exe (PID: 6788 cmdline: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe" MD5: 83E4D0728F822668A2CFF9EF2C227B53)

svchost.exe (PID: 6548 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 6220 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 540 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 3292 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 3652 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 572 -ip 572 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6196 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6788 -ip 6788 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 3816 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2151473629.000000000075D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x15b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2221208662.0000000000688000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1758:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe PID: 572	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: szylttbf.exe PID: 6788	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 6548	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.3.szylttbf.exe.650000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.szylttbf.exe.650000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.szylttbf.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.szylttbf.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.szylttbf.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.szylttbf.exe.650000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.szylttbf.exe.650000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.szylttbf.exe.650000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.szylttbf.exe.650000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.szylttbf.exe.650000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.szylttbf.exe.650000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.szylttbf.exe.620e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.szylttbf.exe.620e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.szylttbf.exe.620e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.szylttbf.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.szylttbf.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.szylttbf.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.szylttbf.exe.650000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.szylttbf.exe.650000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.szylttbf.exe.650000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.szylttbf.exe.620e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.szylttbf.exe.620e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
19.2.svchost.exe.2750000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
19.2.svchost.exe.2750000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
19.2.svchost.exe.2750000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
19.2.svchost.exe.2750000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
19.2.svchost.exe.2750000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
19.2.svchost.exe.2750000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe", ParentImage: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, ParentProcessId: 6788, ParentProcessName: szylttbf.exe, ProcessCommandLine: svchost.exe, ProcessId: 6548, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe, ParentProcessId: 572, ParentProcessName: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 5260, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.47.54.36, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 6548, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49709

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe", ParentImage: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, ParentProcessId: 6788, ParentProcessName: szylttbf.exe, ProcessCommandLine: svchost.exe, ProcessId: 6548, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 6548, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\jcbeaetw

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe, ParentProcessId: 572, ParentProcessName: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 5260, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 3292, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Avira: detected

Antivirus detection for URL or domain

Source: vanaheim.cn:443

Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\szylttbf.exe

Avira: detection malicious, Label: HEUR/AGEN.1318110

Found malware configuration

Source: 12.2.szylttbf.exe.620e67.1.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\szylttbf.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Unpacked PE file: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Unpacked PE file: 12.2.szylttbf.exe.400000.0.unpack

Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\jcbeaetw

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.91 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.133.13.231 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.166.26 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 98.136.96.91 98.136.96.91
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 104.47.54.36 104.47.54.36

Source: Joe Sandbox View	ASN Name: YAHOO-NE1US YAHOO-NE1US
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU
Source: Joe Sandbox View	ASN Name: AS-REGRU AS-REGRU
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: global traffic	TCP traffic: 192.168.2.5:49709 -> 104.47.54.36:25
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 98.136.96.91:25
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 64.233.166.26:25
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 12.2.szylttbf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.650000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.650000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.620e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.szylttbf.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2750000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe PID: 572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: szylttbf.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.3.szylttbf.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.szylttbf.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.szylttbf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.szylttbf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.szylttbf.exe.650000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.szylttbf.exe.650000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.szylttbf.exe.650000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.szylttbf.exe.650000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.szylttbf.exe.620e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.szylttbf.exe.620e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.szylttbf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.szylttbf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.szylttbf.exe.650000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.szylttbf.exe.650000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.szylttbf.exe.620e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.szylttbf.exe.620e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 19.2.svchost.exe.2750000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 19.2.svchost.exe.2750000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 19.2.svchost.exe.2750000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 19.2.svchost.exe.2750000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2151473629.000000000075D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2221208662.0000000000688000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,EntryPoint,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\jcbeaetw\

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_0275C913	19_2_0275C913

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: String function: 021127AB appears 35 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 572 -ip 572

Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.3.szylttbf.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.szylttbf.exe.650000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.szylttbf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.szylttbf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.szylttbf.exe.650000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.szylttbf.exe.650000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.szylttbf.exe.650000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.szylttbf.exe.650000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.szylttbf.exe.620e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.szylttbf.exe.620e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.szylttbf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.szylttbf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.szylttbf.exe.650000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.szylttbf.exe.650000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.szylttbf.exe.620e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.szylttbf.exe.620e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 19.2.svchost.exe.2750000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 19.2.svchost.exe.2750000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 19.2.svchost.exe.2750000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 19.2.svchost.exe.2750000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2151473629.000000000075D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2221208662.0000000000688000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@32/3@9/5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_0075E5DE CreateToolhelp32Snapshot,Module32First,

0_2_0075E5DE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_02759A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	19_2_02759A6B

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3652:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6196:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2604:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

File created: C:\Users\user\AppData\Local\Temp\szylttbf.exe

Jump to behavior

Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_0-15069
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_12-15059

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jcbeaetw\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\szylttbf.exe" C:\Windows\SysWOW64\jcbeaetw\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description jcbeaetw "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start jcbeaetw
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 572 -ip 572
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 1032
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6788 -ip 6788
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 540
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jcbeaetw\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\szylttbf.exe" C:\Windows\SysWOW64\jcbeaetw\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description jcbeaetw "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start jcbeaetw	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 572 -ip 572	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 1032	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6788 -ip 6788	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 540	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Unpacked PE file: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.balowey:W;.xaci:R;.rojoj:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Unpacked PE file: 12.2.szylttbf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.balowey:W;.xaci:R;.rojoj:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Unpacked PE file: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Unpacked PE file: 12.2.szylttbf.exe.400000.0.unpack

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Static PE information: section name: .balowey
Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Static PE information: section name: .xaci
Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Static PE information: section name: .rojoj

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: 0_2_007618C6 push 0000002Bh; iretd		0_2_007618CC
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Code function: 12_2_0068CA6E push 0000002Bh; iretd		12_2_0068CA74

Source: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Static PE information: section name: .text entropy: 7.465820885978803

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	File created: C:\Users\user\AppData\Local\Temp\szylttbf.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\jcbeaetw

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\securiteinfo.com.win32.crypterx-gen.13041.27911.exe

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

19_2_0275199C

Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-16390
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-16511
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_19-7607

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_19-6143

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-16262
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-15440
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_19-7325

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-15256
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_0-15308
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_19-7443

Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_12-15074
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-15086

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	API coverage: 6.0 %
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	API coverage: 4.8 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000013.00000002.3295484043.0000000002C00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_12-16451
Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_19-7668
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_0-16572

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: 0_2_0075DEBB push dword ptr fs:[00000030h]	0_2_0075DEBB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: 0_2_0211092B mov eax, dword ptr fs:[00000030h]	0_2_0211092B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: 0_2_02110D90 mov eax, dword ptr fs:[00000030h]	0_2_02110D90
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Code function: 12_2_0062092B mov eax, dword ptr fs:[00000030h]	12_2_0062092B
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Code function: 12_2_00620D90 mov eax, dword ptr fs:[00000030h]	12_2_00620D90
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Code function: 12_2_00689063 push dword ptr fs:[00000030h]	12_2_00689063

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_02759A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	19_2_02759A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.91 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.133.13.231 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.166.26 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2750000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2750000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2750000			Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 284F008			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jcbeaetw\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\szylttbf.exe" C:\Windows\SysWOW64\jcbeaetw\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description jcbeaetw "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start jcbeaetw	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 572 -ip 572	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 1032	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6788 -ip 6788	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 540	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

0_2_00407809

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 12.2.szylttbf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.650000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.650000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.620e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.szylttbf.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2750000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe PID: 572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: szylttbf.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 12.2.szylttbf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2130000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.650000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.2110e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.650000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.620e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.szylttbf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.szylttbf.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2750000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe PID: 572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: szylttbf.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6548, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_027588B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	19_2_027588B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	22 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	34%	ReversingLabs	Win32.Trojan.CrypterX
SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	100%	Avira	HEUR/AGEN.1318110
SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\szylttbf.exe	100%	Avira	HEUR/AGEN.1318110
C:\Users\user\AppData\Local\Temp\szylttbf.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
jotunheim.name:443	0%	Avira URL Cloud	safe
vanaheim.cn:443	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mxs.mail.ru	217.69.139.150	true	true	unknown
mta5.am0.yahoodns.net	98.136.96.91	true	true	unknown
microsoft-com.mail.protection.outlook.com	104.47.54.36	true	true	unknown
vanaheim.cn	195.133.13.231	true	true	unknown
smtp.google.com	64.233.166.26	true	false	unknown
google.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
98.136.96.91	mta5.am0.yahoodns.net	United States	36646	YAHOO-NE1US	true
64.233.166.26	smtp.google.com	United States	15169	GOOGLEUS	false
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
195.133.13.231	vanaheim.cn	Russian Federation	197695	AS-REGRU	true
104.47.54.36	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1469237
Start date and time:	2024-07-08 17:22:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@32/3@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 68 Number of non-executed functions: 265
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.236.44.162, 20.112.250.133, 20.70.246.20, 20.231.239.246, 20.76.201.171
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Simulations

Behavior and APIs

Time	Type	Description
11:23:58	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
98.136.96.91	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	.exe	Get hash	malicious	Unknown	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	message.txt.exe	Get hash	malicious	Unknown	Browse
	test.dat.exe	Get hash	malicious	Unknown	Browse
	Update-KB7390-x86.exe	Get hash	malicious	Unknown	Browse
217.69.139.150	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse
195.133.13.231	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
104.47.54.36	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	bill.txt.exe	Get hash	malicious	Unknown	Browse
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta5.am0.yahoodns.net	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	67.195.204.72
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.74
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.77
	newtpp.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.77
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	67.195.228.109
	.exe	Get hash	malicious	Unknown	Browse	67.195.228.111
vanaheim.cn	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	62.76.228.127
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	62.76.228.127
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	141.8.199.94
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	141.8.199.94
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	109.107.161.150
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	85.208.208.90
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	77.232.138.239
microsoft-com.mail.protection.outlook.com	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	bill.txt.exe	Get hash	malicious	Unknown	Browse	104.47.54.36
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
mxs.mail.ru	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	yq5xNPpWCT.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	94.100.180.31
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	94.100.180.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAILRU-ASMailRuRU	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	http://ct31152.tw1.ru/	Get hash	malicious	Unknown	Browse	94.100.180.226
	http://cb00287.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	http://cv59800.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	https://cs13786.tw1.ru/	Get hash	malicious	Unknown	Browse	217.69.129.214
	http://cf20871.tw1.ru/	Get hash	malicious	Unknown	Browse	5.61.23.11
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://ahmemorialeducationaltrust-my.sharepoint.com/:o:/g/personal/anitarajendran-coll_presidency_edu_in/EvAuvxLSBnRIuoqh1SaEQtkBFVHwK8EWwIIbP-pKLo1ojA?e=5%3aEiFCka&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://commdado-my.sharepoint.com/:o:/g/personal/dondi_giuseppe_commercialdado_it/EgcvgPn4-NdFixyQ4aFkj6EBbxxwR-oS0CTDFPyJEs3MKA?e=I59h3v&xsdata=MDV8MDJ8dmFsZW50aW5hLml6em9AZW5lcnBhYy5jb218YThmM2EzYTk3YWIzNDA3Y2Y4Y2QwOGRjOWMwZDBjOTJ8MTYwMmFlODIwMjY2NDBkNjkxMGIxMTY4MGZlMGY2YTV8MHwwfDYzODU1NjgyODM1NDc2NjQxNHxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18NDAwMDB8fHw%3d&sdata=OUJxUjdKTmk0R2R2RzNscEJIZjJuWHhXdTJ0YnNCQmoyUmRlOWtxVlZvWT0%3d	Get hash	malicious	Unknown	Browse	51.116.253.170
	https://public-usa.mkt.dynamics.com/api/orgs/d7bf9933-0b3a-ef11-8e4b-000d3a106c0b/r/TDEgwpm1AUWqGuhxxSAcVwAAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Flink.mail.beehiiv.com%252Fls%252Fclick%253Fupn%253Du001.zV-2FAVEm-2FntcfbYMbzjaqbKZhAB-2FHhugJeFwz-2B4eDrq0xOMBQTM6qlBDRp75xHtySEdSKBszynN0RsLNImFmRmJGSCpsyuJM9bG8EB51sE4kW8XhzvRA-2BPtYYa-2B8QdjWMLCGEPxD3KrjRK89cl78vwPZBLWr2w7GMKSrXIn6S5ME-3DNlCi_04d4ywoI7MJdsiYCN-2BN3DcUV-2B5xfwat-2BOgMDujJ1c-2F1Yv6NlNivSyla3VBW2cjbr1yCOzHfMtbC8Z-2F4vXjnE7ALgpquLSNdhC7u38lmdLt2T6ipD6w6zyxyCHgz0XVbQES5WlZWU5UK-2F7jiXFjJMZnUhx-2BmdMZRiz6S2UNsBylqJ0eRKaX7ox8IC1QS9BJs-2FOp5ANI-2F3N9-2BkzY0zfUpu34-2FJzKpSaGCuqlPgMs88LTPgmgOGL4Q-2FnrnbiXZBJHFlVZxGFxtQ9ikryZpedOQgzoJOiPHqeU1B-2FuiPrZyb-2FCU8AyhbjwazN6wkHgNMqW2U421Q3Bse8i1IPiy6FmhXBqCiy71NcD1RwBQ1vXLrObsqZ08rjy-2Fvnv6paNjRw2yjigHa6OFZOGU-2BhN8d06w7h9ZANDTIwsYFfg1gNLn-2BA5B9bLK0s0uLZkFU4rvvWMQU%2523_msdynmkt_donottrack%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%220%22%3Anull%7D%7D&digest=d6IExTJM16fguE87xMA5SuNRU%2BKUfss25XRRndnMwLY%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	Get hash	malicious	Unknown	Browse	52.146.76.30
	Invoice #INV-97267267 is due for auto-renewals.zip	Get hash	malicious	Unknown	Browse	20.50.73.4
	https://hr.economictimes.indiatimes.com/etl.php?url=https://link.mail.beehiiv.com/ls/click?upn=u001.C7CyaRD6J7Tdcqj9-2FMOqGE7r0wgi8kv64sAcgUPyKxo5WVoDX535gK1GDXQwPdAQrihn70HxgcGt2YBaUq1CgXa4w9UpnKYDWVk4wstl4BzTl0nByfbAMK9adrJtPNZDcYNrLz06jcC5tefVJ0MSELmrJVBWp2H-2FJNpadLpkW49aZHb0SN7faZdRSrGyWuvMdp4__d7CEfkoadLhLBotLDjFJV7Gf-2FGq-2FLbbkNC53nfsKxrXBgvOKDfwaSxCVShLSUOB96Cn1WOBmKtjwKglvs4Ik-2BSw75NpxJFloSreNjVrf23EvzQ1FRnAoElvJF-2B8D-2BMukEyUOFyqiDfOcPKVuQi4IrT2aGHp2KaoeXacWORZxyg-2BV2JHBFjW8KSG6ohd2I1l-2Bys1eXb0UaY6hTGOmp7v7bQMT64tqZtgUnbI7dAvCSbjKmaiKyIN7QZWXlla-2Bl8SOGSAyzrZKFQV17NyAoV171-2FYqo1ABGkQoLEipNqxGy4lfga0v-2FXAFNABPZkTJ1ZqclpC2FUhBDYSM-2Bab4YaBlh-2BErAoNeIxttwbVnYGtNKIF4zBYqTFz4qjHn2b3VZ8BmkRPY4ofkEnlvrjKe2YQtpdmmW90mogImF21NdSt2XKUr9ey1x1i70RJFZn5ES3dC	Get hash	malicious	Unknown	Browse	13.107.246.42
	https://app.smartdraw.com/share.aspx/?pubDocShare=8BF69438A0CE0C51404F4607C82DF20E2D0	Get hash	malicious	Unknown	Browse	20.84.234.130
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	https://m.exactag.com/ai.aspx?tc=d9725599bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Amouradmikhail.com%2Fwinner%2F33008%2F%2FYS5zZWd1bmFAYW5kYXJpYS5jb20=	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	94.245.104.56
	RFQ - From Arcadia Aerospace Industries Entry CodeRBW51-PU5Y-9A5R.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.42
AS-REGRU	Order 81307529516.LZ.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	DRAFT CONTRACT COPY_938840.scr	Get hash	malicious	FormBook	Browse	194.58.112.174
	Shipping Documents.exe	Get hash	malicious	FormBook	Browse	37.140.192.90
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	Scan405.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	ScanPDF_102.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	TOgpmvvWoj.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	AuT5pFGTFw.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
YAHOO-NE1US	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	98.136.96.75
	s4WsI8Qcm4.elf	Get hash	malicious	Mirai, Moobot	Browse	98.139.105.91
	NgAzrOQSgK.elf	Get hash	malicious	Mirai	Browse	98.139.7.69
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	V#U2550DEOS.EXE	Get hash	malicious	Brontok	Browse	74.6.231.20
	vylI38MZOn.elf	Get hash	malicious	Mirai	Browse	98.137.87.64
	https://www.canva.com/design/DAGDiia04Xg/_SQxN5BXpIl2RgDD44fATw/edit?utm_content=DAGDiia04Xg&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	98.137.155.8
	P5uKPY120j.elf	Get hash	malicious	Mirai	Browse	216.252.107.75
	806aab44-6c03-4577-a3c4-83aa13dc7875.tmp	Get hash	malicious	Unknown	Browse	98.137.155.8

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11432960
Entropy (8bit):	5.220017315820614
Encrypted:	false
SSDEEP:	6144:BLNXXUki1mTUmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBl:BRHCcT
MD5:	83E4D0728F822668A2CFF9EF2C227B53
SHA1:	15C0C2011BC56C18F2D6F16777149597F7C38E54
SHA-256:	9A043CE162703B46A72571561FEE1AD07175BA7E604CB33B06E882146FF6C766
SHA-512:	DA1689085251433F70EA44D6CFC16B780E9A4E9581187A4095A8B77328DF6089814A5C360B10775398EE091A8C9407F980A3A43FC2178162048BBAC7E2384133
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........bq..."..."..."..."..."..."..."..."...".(w"..."..."..."..."..."..."..."..."..."Rich..."........................PE..L.....ad.................l........................@..........................@......."..........................................P....`..................................................................................p............................text....k.......l.................. ..`.rdata... ......."...p..............@..@.data...<c..........................@....balowey\|.... ......................@....xaci........@......................@..@.rojoj.......P......................@....rsrc........`......................@..@........................................................................................................................................................................................................................................

C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11432960
Entropy (8bit):	5.220017315820614
Encrypted:	false
SSDEEP:	6144:BLNXXUki1mTUmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBmHBl:BRHCcT
MD5:	83E4D0728F822668A2CFF9EF2C227B53
SHA1:	15C0C2011BC56C18F2D6F16777149597F7C38E54
SHA-256:	9A043CE162703B46A72571561FEE1AD07175BA7E604CB33B06E882146FF6C766
SHA-512:	DA1689085251433F70EA44D6CFC16B780E9A4E9581187A4095A8B77328DF6089814A5C360B10775398EE091A8C9407F980A3A43FC2178162048BBAC7E2384133
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........bq..."..."..."..."..."..."..."..."...".(w"..."..."..."..."..."..."..."..."..."Rich..."........................PE..L.....ad.................l........................@..........................@......."..........................................P....`..................................................................................p............................text....k.......l.................. ..`.rdata... ......."...p..............@..@.data...<c..........................@....balowey\|.... ......................@....xaci........@......................@..@.rojoj.......P......................@....rsrc........`......................@..@........................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.552164584453548
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe
File size:	168'960 bytes
MD5:	56781772c92e1822beec9faee18fadc9
SHA1:	889af8e28ecda1df1e79c1f4abe533959b29a9db
SHA256:	4f0a6b89e63437c52a7adf09a15950b3ba5b9d1d7c8791a8559721ae24875894
SHA512:	7a46f160e3881578c8991ed07a746696738eb994b8f161796ef87081d1d6345927149f168197300750862564b672abaf522db193aa43d980aeef2abd115a460f
SSDEEP:	3072:jJLNXOgUQ4IiNpjhmD/Sc11y5Td0Cfq/UVwE7wQWLc:NLNXXUki1mTUmH
TLSH:	31F34A6076F59136F3F79A341A74A6A41A3BF8736936C18EAE50121B0D336C19EE1F13
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........bq..."..."..."..."..."..."..."..."...".(w"..."..."..."..."..."..."..."..."..."Rich..."........................PE..L.....ad...

File Icon


Icon Hash:	cb97354d5555599a

Static PE Info

General

Entrypoint:	0x40169b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6461F0CE [Mon May 15 08:43:58 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	5208417a665309604e7c3226aaaeb5e4

Entrypoint Preview

Instruction
call 00007F4F74EBB7BDh
jmp 00007F4F74EB767Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0041C818h], eax
mov dword ptr [0041C814h], ecx
mov dword ptr [0041C810h], edx
mov dword ptr [0041C80Ch], ebx
mov dword ptr [0041C808h], esi
mov dword ptr [0041C804h], edi
mov word ptr [0041C830h], ss
mov word ptr [0041C824h], cs
mov word ptr [0041C800h], ds
mov word ptr [0041C7FCh], es
mov word ptr [0041C7F8h], fs
mov word ptr [0041C7F4h], gs
pushfd
pop dword ptr [0041C828h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0041C81Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0041C820h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0041C82Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0041C768h], 00010001h
mov eax, dword ptr [0041C820h]
mov dword ptr [0041C71Ch], eax
mov dword ptr [0041C710h], C0000409h
mov dword ptr [0041C714h], 00000001h
mov eax, dword ptr [0041B004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0041B008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [00000094h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1988c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb6000	0xdbb8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x18000	0x170	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16b10	0x16c00	0ebc79b2a3798792e0658b7b079d1681	False	0.7967891483516484	data	7.465820885978803	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x20c0	0x2200	c20193acc30729fe20d80c398acfefe8	False	0.3625919117647059	data	5.451629537787536	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x9633c	0x1800	897508375183028ff55df2d5b9feab62	False	0.14892578125	data	1.6086341555943506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.balowey	0xb2000	0x107c	0x800	c99a74c555371a433d121f551d6c6398	False	0.01123046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.xaci	0xb4000	0xc	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rojoj	0xb5000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xb6000	0xdbb8	0xdc00	7d501b5057fbdae1abc422181e773c68	False	0.5225319602272728	data	5.193791367871725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
POJ	0xbcee8	0x3fa	ASCII text, with very long lines (1018), with no line terminators	Turkish	Turkey	0.6326129666011788
RT_CURSOR	0xbd300	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4276315789473684
RT_ICON	0xb66b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.6108742004264393
RT_ICON	0xb7558	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6917870036101083
RT_ICON	0xb7e00	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.7517281105990783
RT_ICON	0xb84c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.7955202312138728
RT_ICON	0xb8a30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.5929460580912863
RT_ICON	0xbafd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.7223264540337712
RT_ICON	0xbc080	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.7360655737704918
RT_ICON	0xbca08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.8838652482269503
RT_STRING	0xbd5f8	0x19c	data			0.5072815533980582
RT_STRING	0xbd798	0x636	data			0.44150943396226416
RT_STRING	0xbddd0	0x7f8	data			0.42205882352941176
RT_STRING	0xbe5c8	0x52a	data			0.443267776096823
RT_STRING	0xbeaf8	0x258	data			0.4816666666666667
RT_STRING	0xbed50	0x70c	data			0.43015521064301554
RT_STRING	0xbf460	0x592	data			0.44600280504908835
RT_STRING	0xbf9f8	0x69a	data			0.4307692307692308
RT_STRING	0xc0098	0x63a	data			0.43224592220828106
RT_STRING	0xc06d8	0x9c8	data			0.40894568690095845
RT_STRING	0xc10a0	0x8fc	data			0.40956521739130436
RT_STRING	0xc19a0	0x5cc	data			0.44070080862533695
RT_STRING	0xc1f70	0x618	data			0.43653846153846154
RT_STRING	0xc2588	0x690	data			0.43392857142857144
RT_STRING	0xc2c18	0x6e6	data			0.42638731596828994
RT_STRING	0xc3300	0x86c	data			0.4114100185528757
RT_STRING	0xc3b70	0x46	data			0.6142857142857143
RT_ACCELERATOR	0xbd2e8	0x18	data			1.2916666666666667
RT_GROUP_CURSOR	0xbd430	0x14	data			1.15
RT_GROUP_ICON	0xbce70	0x76	data	Turkish	Turkey	0.6610169491525424
RT_VERSION	0xbd448	0x1b0	data			0.5925925925925926

Imports

DLL	Import
KERNEL32.dll	CreateJobObjectW, SleepEx, GetCommProperties, GetModuleHandleW, GetConsoleAliasesA, GlobalAlloc, SetVolumeMountPointA, lstrcpynW, GetModuleFileNameW, SetConsoleTitleA, ReleaseActCtx, SetLastError, GetProcAddress, BuildCommDCBW, GetAtomNameA, LoadLibraryA, WriteConsoleA, UnhandledExceptionFilter, InterlockedExchangeAdd, SetFileApisToANSI, AddAtomA, OpenJobObjectW, FoldStringW, lstrcatW, EnumDateFormatsW, FindFirstVolumeA, LocalFree, FlushFileBuffers, CloseHandle, GetLastError, HeapFree, MultiByteToWideChar, HeapAlloc, GetStartupInfoW, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, InitializeCriticalSectionAndSpinCount, RtlUnwind, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, GetConsoleOutputCP, WriteConsoleW, HeapSize, CreateFileA
USER32.dll	GetProcessDefaultLayout
WINHTTP.dll	WinHttpAddRequestHeaders

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 8, 2024 17:23:15.843873024 CEST	49709	25	192.168.2.5	104.47.54.36
Jul 8, 2024 17:23:16.936583042 CEST	49709	25	192.168.2.5	104.47.54.36
Jul 8, 2024 17:23:18.936575890 CEST	49709	25	192.168.2.5	104.47.54.36
Jul 8, 2024 17:23:19.017240047 CEST	49713	443	192.168.2.5	195.133.13.231
Jul 8, 2024 17:23:19.017292023 CEST	443	49713	195.133.13.231	192.168.2.5
Jul 8, 2024 17:23:19.017353058 CEST	49713	443	192.168.2.5	195.133.13.231
Jul 8, 2024 17:23:22.952213049 CEST	49709	25	192.168.2.5	104.47.54.36
Jul 8, 2024 17:23:30.967886925 CEST	49709	25	192.168.2.5	104.47.54.36
Jul 8, 2024 17:23:35.876173019 CEST	49714	25	192.168.2.5	98.136.96.91
Jul 8, 2024 17:23:36.889805079 CEST	49714	25	192.168.2.5	98.136.96.91
Jul 8, 2024 17:23:38.905385971 CEST	49714	25	192.168.2.5	98.136.96.91
Jul 8, 2024 17:23:42.920979023 CEST	49714	25	192.168.2.5	98.136.96.91
Jul 8, 2024 17:23:50.921092033 CEST	49714	25	192.168.2.5	98.136.96.91
Jul 8, 2024 17:23:55.905966043 CEST	49716	25	192.168.2.5	64.233.166.26
Jul 8, 2024 17:23:56.920952082 CEST	49716	25	192.168.2.5	64.233.166.26
Jul 8, 2024 17:23:58.921118021 CEST	49716	25	192.168.2.5	64.233.166.26
Jul 8, 2024 17:23:59.014839888 CEST	49713	443	192.168.2.5	195.133.13.231
Jul 8, 2024 17:23:59.015059948 CEST	443	49713	195.133.13.231	192.168.2.5
Jul 8, 2024 17:23:59.015866995 CEST	49713	443	192.168.2.5	195.133.13.231
Jul 8, 2024 17:23:59.125675917 CEST	49717	443	192.168.2.5	195.133.13.231
Jul 8, 2024 17:23:59.125731945 CEST	443	49717	195.133.13.231	192.168.2.5
Jul 8, 2024 17:23:59.125858068 CEST	49717	443	192.168.2.5	195.133.13.231
Jul 8, 2024 17:24:02.921040058 CEST	49716	25	192.168.2.5	64.233.166.26
Jul 8, 2024 17:24:10.936629057 CEST	49716	25	192.168.2.5	64.233.166.26
Jul 8, 2024 17:24:16.131616116 CEST	49718	25	192.168.2.5	217.69.139.150
Jul 8, 2024 17:24:17.124058008 CEST	49718	25	192.168.2.5	217.69.139.150
Jul 8, 2024 17:24:19.127422094 CEST	49718	25	192.168.2.5	217.69.139.150
Jul 8, 2024 17:24:23.124085903 CEST	49718	25	192.168.2.5	217.69.139.150
Jul 8, 2024 17:24:31.124102116 CEST	49718	25	192.168.2.5	217.69.139.150
Jul 8, 2024 17:24:39.140100002 CEST	49717	443	192.168.2.5	195.133.13.231
Jul 8, 2024 17:24:39.140403986 CEST	443	49717	195.133.13.231	192.168.2.5
Jul 8, 2024 17:24:39.140552044 CEST	49717	443	192.168.2.5	195.133.13.231
Jul 8, 2024 17:24:39.249994040 CEST	49719	443	192.168.2.5	195.133.13.231
Jul 8, 2024 17:24:39.250044107 CEST	443	49719	195.133.13.231	192.168.2.5
Jul 8, 2024 17:24:39.250163078 CEST	49719	443	192.168.2.5	195.133.13.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 8, 2024 17:23:15.585850000 CEST	59858	53	192.168.2.5	1.1.1.1
Jul 8, 2024 17:23:15.842935085 CEST	53	59858	1.1.1.1	192.168.2.5
Jul 8, 2024 17:23:18.519751072 CEST	51554	53	192.168.2.5	1.1.1.1
Jul 8, 2024 17:23:19.016736984 CEST	53	51554	1.1.1.1	192.168.2.5
Jul 8, 2024 17:23:35.859358072 CEST	64174	53	192.168.2.5	1.1.1.1
Jul 8, 2024 17:23:35.866733074 CEST	53	64174	1.1.1.1	192.168.2.5
Jul 8, 2024 17:23:35.867619038 CEST	59297	53	192.168.2.5	1.1.1.1
Jul 8, 2024 17:23:35.875583887 CEST	53	59297	1.1.1.1	192.168.2.5
Jul 8, 2024 17:23:55.890255928 CEST	50129	53	192.168.2.5	1.1.1.1
Jul 8, 2024 17:23:55.897691011 CEST	53	50129	1.1.1.1	192.168.2.5
Jul 8, 2024 17:23:55.898361921 CEST	52866	53	192.168.2.5	1.1.1.1
Jul 8, 2024 17:23:55.905390978 CEST	53	52866	1.1.1.1	192.168.2.5
Jul 8, 2024 17:24:15.921591043 CEST	52224	53	192.168.2.5	1.1.1.1
Jul 8, 2024 17:24:16.122243881 CEST	53	52224	1.1.1.1	192.168.2.5
Jul 8, 2024 17:24:16.123073101 CEST	64152	53	192.168.2.5	1.1.1.1
Jul 8, 2024 17:24:16.131067991 CEST	53	64152	1.1.1.1	192.168.2.5
Jul 8, 2024 17:25:03.881047964 CEST	61671	53	192.168.2.5	1.1.1.1
Jul 8, 2024 17:25:03.911577940 CEST	53	61671	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 8, 2024 17:23:15.585850000 CEST	192.168.2.5	1.1.1.1	0x9f22	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:18.519751072 CEST	192.168.2.5	1.1.1.1	0x3319	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:35.859358072 CEST	192.168.2.5	1.1.1.1	0x3e56	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Jul 8, 2024 17:23:35.867619038 CEST	192.168.2.5	1.1.1.1	0xf2cf	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:55.890255928 CEST	192.168.2.5	1.1.1.1	0xf2b6	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Jul 8, 2024 17:23:55.898361921 CEST	192.168.2.5	1.1.1.1	0xaac9	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:24:15.921591043 CEST	192.168.2.5	1.1.1.1	0x532e	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Jul 8, 2024 17:24:16.123073101 CEST	192.168.2.5	1.1.1.1	0x1c2	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:25:03.881047964 CEST	192.168.2.5	1.1.1.1	0x3298	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 8, 2024 17:23:15.842935085 CEST	1.1.1.1	192.168.2.5	0x9f22	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:15.842935085 CEST	1.1.1.1	192.168.2.5	0x9f22	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:19.016736984 CEST	1.1.1.1	192.168.2.5	0x3319	No error (0)	vanaheim.cn	195.133.13.231	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:35.866733074 CEST	1.1.1.1	192.168.2.5	0x3e56	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Jul 8, 2024 17:23:35.866733074 CEST	1.1.1.1	192.168.2.5	0x3e56	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Jul 8, 2024 17:23:35.866733074 CEST	1.1.1.1	192.168.2.5	0x3e56	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Jul 8, 2024 17:23:35.875583887 CEST	1.1.1.1	192.168.2.5	0xf2cf	No error (0)	mta5.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:35.875583887 CEST	1.1.1.1	192.168.2.5	0xf2cf	No error (0)	mta5.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:35.875583887 CEST	1.1.1.1	192.168.2.5	0xf2cf	No error (0)	mta5.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:35.875583887 CEST	1.1.1.1	192.168.2.5	0xf2cf	No error (0)	mta5.am0.yahoodns.net	67.195.228.110	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:35.875583887 CEST	1.1.1.1	192.168.2.5	0xf2cf	No error (0)	mta5.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:35.875583887 CEST	1.1.1.1	192.168.2.5	0xf2cf	No error (0)	mta5.am0.yahoodns.net	98.136.96.75	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:35.875583887 CEST	1.1.1.1	192.168.2.5	0xf2cf	No error (0)	mta5.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:35.875583887 CEST	1.1.1.1	192.168.2.5	0xf2cf	No error (0)	mta5.am0.yahoodns.net	67.195.204.72	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:55.897691011 CEST	1.1.1.1	192.168.2.5	0xf2b6	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Jul 8, 2024 17:23:55.905390978 CEST	1.1.1.1	192.168.2.5	0xaac9	No error (0)	smtp.google.com	64.233.166.26	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:55.905390978 CEST	1.1.1.1	192.168.2.5	0xaac9	No error (0)	smtp.google.com	74.125.133.26	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:55.905390978 CEST	1.1.1.1	192.168.2.5	0xaac9	No error (0)	smtp.google.com	74.125.71.27	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:55.905390978 CEST	1.1.1.1	192.168.2.5	0xaac9	No error (0)	smtp.google.com	74.125.71.26	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:23:55.905390978 CEST	1.1.1.1	192.168.2.5	0xaac9	No error (0)	smtp.google.com	74.125.133.27	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:24:16.122243881 CEST	1.1.1.1	192.168.2.5	0x532e	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Jul 8, 2024 17:24:16.131067991 CEST	1.1.1.1	192.168.2.5	0x1c2	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:24:16.131067991 CEST	1.1.1.1	192.168.2.5	0x1c2	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:25:03.911577940 CEST	1.1.1.1	192.168.2.5	0x3298	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Jul 8, 2024 17:25:03.911577940 CEST	1.1.1.1	192.168.2.5	0x3298	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:22:55
Start date:	08/07/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe"
Imagebase:	0x400000
File size:	168'960 bytes
MD5 hash:	56781772C92E1822BEEC9FAEE18FADC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2151473629.000000000075D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.2110248416.0000000002130000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:23:04
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jcbeaetw\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:23:04
Start date:	08/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:23:04
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\szylttbf.exe" C:\Windows\SysWOW64\jcbeaetw\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:23:04
Start date:	08/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:23:05
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create jcbeaetw binPath= "C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d\"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xc90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:23:05
Start date:	08/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:23:05
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description jcbeaetw "wifi internet conection"
Imagebase:	0xc90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:23:05
Start date:	08/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:23:06
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start jcbeaetw
Imagebase:	0xc90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:23:06
Start date:	08/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:23:06
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe /d"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe"
Imagebase:	0x400000
File size:	11'432'960 bytes
MD5 hash:	83E4D0728F822668A2CFF9EF2C227B53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2221092359.0000000000650000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2221208662.0000000000688000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.2206909011.0000000000650000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:23:07
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:23:07
Start date:	08/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	11:23:07
Start date:	08/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:23:07
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 572 -ip 572
Imagebase:	0xca0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:23:07
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 1032
Imagebase:	0xca0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:23:13
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x6f0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	11:23:13
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6788 -ip 6788
Imagebase:	0xca0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:23:14
Start date:	08/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 540
Imagebase:	0xca0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:23:40
Start date:	08/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	2.2%
Signature Coverage:	24.7%
Total number of Nodes:	1601
Total number of Limit Nodes:	32

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

P, xrefs: 00409DAA
\, xrefs: 00409D0C
", xrefs: 0040A078
D, xrefs: 00409F8E
", xrefs: 0040A189
", xrefs: 00409EDB
%X%08X, xrefs: 0040A0B0
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID: PromptOnSecureDesktop
API String ID: 3188212458-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 0075E5DE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0075E606
Module32First.KERNEL32(00000000,00000224), ref: 0075E626

Memory Dump Source

Source File: 00000000.00000002.2151473629.000000000075D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: ce29e37832e691e89dcb5b12f8c7cb04db4c3fdd9accde7fac70928b22ef9fb5
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E1F096311007146BD7243BF59C8DBEEB6ECEF59766F100528FA52D10C0EBB4ED494A61

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 0041782A Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 212
stringmemorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,00000000), ref: 004178BD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004178CB
WriteConsoleA.KERNEL32(00000000,?,00000000,?,00000000), ref: 004178E2
lstrcpynW.KERNEL32(?,00000000,00000000), ref: 004178F1
GetAtomNameA.KERNEL32(00000000,00000000,00000000), ref: 004178FA
SetFileApisToANSI.KERNEL32 ref: 00417900
SetVolumeMountPointA.KERNEL32(00000000,00000000), ref: 00417908
GetModuleFileNameW.KERNEL32(00000000,?,00000000), ref: 00417917
EnumDateFormatsW.KERNEL32(00000000,00000000,00000000), ref: 00417920
GlobalAlloc.KERNEL32(00000000,00000000), ref: 00417958
AddAtomA.KERNEL32(00000000), ref: 0041795F
GetCommProperties.KERNELBASE(00000000,?), ref: 0041796D
SetLastError.KERNEL32(00000000), ref: 00417974
GetProcessDefaultLayout.USER32(00000000), ref: 00417983
ReleaseActCtx.KERNEL32(00000000), ref: 00417996
GetConsoleAliasesA.KERNEL32(?,00000000,00000000), ref: 004179A5
FoldStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004179C1
SetConsoleTitleA.KERNEL32(00000000), ref: 00417A05
LocalFree.KERNEL32(00000000), ref: 00417A0C
LoadLibraryA.KERNELBASE(00419458), ref: 00417AA0

Strings

k`, xrefs: 00417AB4
tl_, xrefs: 0041789E
}$, xrefs: 00417AC1

Memory Dump Source

Source File: 00000000.00000002.2150586425.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_SecuriteInfo.jbxd

Similarity

API ID: Console$AtomFileName$AliasesAllocApisCommDateDefaultEnumErrorExchangeFoldFormatsFreeGlobalInterlockedLastLayoutLibraryLoadLocalModuleMountPointProcessPropertiesReleaseStringTitleVolumeWritelstrcatlstrcpyn
String ID: k`$tl_$}$
API String ID: 1756273361-211918992
Opcode ID: 3697615f451d7fc26fb8104d22a62db024d6b7e65e0f42aee9dd171e956c996e
Instruction ID: b72458c26081517cb692f213dc5e595fb7550a1c7ca338c38081d81411803abd
Opcode Fuzzy Hash: 3697615f451d7fc26fb8104d22a62db024d6b7e65e0f42aee9dd171e956c996e
Instruction Fuzzy Hash: 76617E71909524ABD725AB66EC48DDF7F7CEF0A395B10403EF106D2161CB388A85CBAD

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 0211003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0211024D

Strings

kernel32.dll, xrefs: 0211008F, 02110095
cess, xrefs: 0211018D

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 74c52d792651154b35292d0624a265a8ac5351d2dd942f5d0c11e8719098d6e9
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 95525874E01229DFDB64CF58C984BA8BBB1BF09304F1580E9E94DAB351DB30AA85CF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 02110E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02110223,?,?), ref: 02110E19
SetErrorMode.KERNELBASE(00000000,?,?,02110223,?,?), ref: 02110E1E

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f41980ae68ce685da741fb8abaf3e2b422b08bc76916466801f808e01ad358d5
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: C9D0123154512877DB002A95DC09BCD7B1CDF09B66F108021FB0DD9080C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 004175E2 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 004175F8

Memory Dump Source

Source File: 00000000.00000002.2150586425.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4e90e5151ba5019126abd3050a43543751f9b5068c80efb2043434d2877197fe
Instruction ID: aa73c9f825d5df17848c24f377238b424e705aacf1c0d2419f86f1d3d7c4eb2b
Opcode Fuzzy Hash: 4e90e5151ba5019126abd3050a43543751f9b5068c80efb2043434d2877197fe
Instruction Fuzzy Hash: ABC08CB1200209BFCB018B85FC01E863B6CE305384F004071F302A00B0C2B2E9049B1C

Function 0075E29D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0075E2EE

Memory Dump Source

Source File: 00000000.00000002.2151473629.000000000075D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 15a2667ae4da40aefa902450df974e0364af27d424f3b71206e92b41dcf494ba
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: C8112D79A00208EFDB01DF98C985E98BBF5AF08351F158094F9889B362E375EA50DB80

Function 004175C3 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,00417A4D), ref: 004175CB

Memory Dump Source

Source File: 00000000.00000002.2150586425.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_SecuriteInfo.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 1b8ec44056b00309cc5f266c182984128dcf6dbdfddfd59655b0be00dbed23e0
Instruction ID: 274654774a60fdf00fd51e05caba7627b891178c4aca089a58273a46cc3454b5
Opcode Fuzzy Hash: 1b8ec44056b00309cc5f266c182984128dcf6dbdfddfd59655b0be00dbed23e0
Instruction Fuzzy Hash: CFB011B00002008FCB800FA8EC08B023EA2A30A383F028038E200882B0CBB20008AF2A

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
\, xrefs: 0040D3A7
local_time, xrefs: 0040CACD
\, xrefs: 0040D39D
srv_time, xrefs: 0040CABB
wtm_w, xrefs: 0040C96C
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
@, xrefs: 0040D754
4, xrefs: 0040D9F7
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
lid_file_upd, xrefs: 0040CE6A
drivers\, xrefs: 0040D067
wtm_c, xrefs: 0040C956
flags_upd, xrefs: 0040CE4A
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
.sys, xrefs: 0040D0CC
wtm_r, xrefs: 0040C97F

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlSetLastWin32Error, xrefs: 004010D6
NtSetInformationThread, xrefs: 00401155
NtClose, xrefs: 004011B4
NtOpenProcessToken, xrefs: 004011D4
RtlLengthSid, xrefs: 00401246
NtTerminateProcess, xrefs: 004010F6
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtSetInformationToken, xrefs: 00401175
NtFilterToken, xrefs: 0040122B
ntdll.dll, xrefs: 0040100D
RtlNtStatusToDosError, xrefs: 00401194
NtQueryInformationToken, xrefs: 00401262
RtlFreeSid, xrefs: 00401116
RtlInitUnicodeString, xrefs: 00401135
NtDuplicateToken, xrefs: 004011F3
RtlExpandEnvironmentStrings_U, xrefs: 004010BC

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Mon, xrefs: 0040B22C
Jun, xrefs: 0040B279
Jan, xrefs: 0040B256
Sat, xrefs: 0040B24F
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Apr, xrefs: 0040B26B
May, xrefs: 0040B272
Tue, xrefs: 0040B233
Wed, xrefs: 0040B23A
Nov, xrefs: 0040B29C
Sep, xrefs: 0040B28E
Fri, xrefs: 0040B248
Jul, xrefs: 0040B280
Aug, xrefs: 0040B287
Thu, xrefs: 0040B241
Sun, xrefs: 0040B225
Oct, xrefs: 0040B295
Mar, xrefs: 0040B264
Feb, xrefs: 0040B25D
Dec, xrefs: 0040B2A3

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

PDGu, xrefs: 0040139A
wusa.exe, xrefs: 00401388
uac, xrefs: 00401628
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
, xrefs: 00401462
<, xrefs: 00401378
useless, xrefs: 0040161E
D, xrefs: 004015C6

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

net_type, xrefs: 00401E87
work_srv, xrefs: 00401E5E
lid_file_upd, xrefs: 00401E25
IsWow64Process, xrefs: 00401DF2
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
born_date, xrefs: 00401EAD, 00401ECC
start_srv, xrefs: 00401E6C
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
loader_id, xrefs: 00401F4B, 00401F6B
kernel32, xrefs: 00401DF7

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 021165E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 021165F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02116610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02116631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02116652

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 4ef987e59a1ff26dc06246e9f977253eda83deec6426c855d9175ddd8c08fd96
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: BF115171640258BFDB219F65DC45F9B3FACEB057A5F114034FA08A7250D7B2DD00CAA4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 0211092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0211095F
l, xrefs: 02110966
GetProcAddress., xrefs: 021109DC, 021109DF, 021109E4

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: d486d75307bc883e2e3f020181736d47453b96a2fc3586c5d122d2491ae3b294
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: DD316CB6900609DFDB10CF99C880AAEBBF5FF48324F15405AD845AB314D771EA85CFA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 0075DEBB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151473629.000000000075D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0075D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 6728cd2c3d15268954ffd0c871168b7df9a110a906aabce516f229df2b96af7c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 5311CE72340100AFDB60DF55DC81FE273EAEB89320B298069ED05CB346E6BAEC01C760

Function 02110D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 7475680157ac40bf35106480223050aa579ca0c61c8a9dcb87d03faee0e78f5d
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 8101F272F516008FDF21CF20C804BAA33E5EB8A206F1540B8DD0A97285E370A8818B80

Function 02119EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02119E6D
lstrcpy.KERNEL32(?,00000000), ref: 02119FE1
lstrcat.KERNEL32(?,?), ref: 02119FF2
lstrcat.KERNEL32(?,0041070C), ref: 0211A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0211A054
DeleteFileA.KERNEL32(?), ref: 0211A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0211A0D6
lstrcpy.KERNEL32 ref: 0211A12F
lstrlen.KERNEL32(00000022), ref: 0211A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 02119F13

Part of subcall function 02117029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02117081

Part of subcall function 02116F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\slknjncf,02117043), ref: 02116F4E
Part of subcall function 02116F30: GetProcAddress.KERNEL32(00000000), ref: 02116F55
Part of subcall function 02116F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02116F7B
Part of subcall function 02116F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02116F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0211A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0211A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0211A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0211A21B
GetDriveTypeA.KERNEL32(?), ref: 0211A265
lstrcat.KERNEL32(?,00000000), ref: 0211A29F
lstrcat.KERNEL32(?,00410A34), ref: 0211A2C5
lstrcat.KERNEL32(?,00000022), ref: 0211A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0211A2F4
wsprintfA.USER32 ref: 0211A31D
lstrcat.KERNEL32(?,00000000), ref: 0211A345
lstrcat.KERNEL32(?,?), ref: 0211A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0211A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0211A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0211A1D1

Part of subcall function 02119966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0211999D
Part of subcall function 02119966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 021199BD
Part of subcall function 02119966: RegCloseKey.ADVAPI32(?), ref: 021199C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0211A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0211A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0211A41D

Strings

P, xrefs: 0211A011
", xrefs: 0211A3F0
", xrefs: 0211A2DF
\, xrefs: 02119F73
D, xrefs: 0211A1F5
", xrefs: 0211A142

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 0154da514c3152c6b5df5e571ca0d76625c2efa43efcb352798cec8611ca36bb
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: C2F13DB1C81259AEDB21DBA08C48FEF7BBDAF08304F1444B6E619E2141E7759A85CF64

Function 02117CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02117D21
GetUserNameA.ADVAPI32(?,?), ref: 02117D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02117D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02117DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02117DC0
EqualSid.ADVAPI32(?,?), ref: 02117DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 02117DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02117DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02117E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02117E12
LocalFree.KERNEL32(00000000), ref: 02117E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02117E35

Strings

PromptOnSecureDesktop, xrefs: 02117FA0
D, xrefs: 02117D73

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 2186345fc2f4605a4f8cc8b661bdaa0307699769d3fed5b78921a335f5bab0a5
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 8AA16B71940219AFDF118FA0DC88FEFBBB9FB08344F14817AE515E6290D7758A86CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

Jan 13 2018, xrefs: 0040653A
va=%08X%08X uef=%p, xrefs: 00406595
except_info, xrefs: 00406728
plgs:, xrefs: 004066AA
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
12:08:32, xrefs: 00406535
%d=%p, xrefs: 004066F9
localcfg, xrefs: 0040672D
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ESMTP, xrefs: 0040AA38
data, xrefs: 0040A85E
Too big smtp respons (%d bytes), xrefs: 0040A9B1
., xrefs: 0040A8CA
AUTH LOGIN, xrefs: 0040A80C
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
rcpt to:<%s>, xrefs: 0040A855
ehlo %s, xrefs: 0040A7F5
quit, xrefs: 0040A86C
Incorrect respons, xrefs: 0040AB39
localcfg, xrefs: 0040AB0B
mail from:<%s>, xrefs: 0040A848
helo %s, xrefs: 0040A803
Too small respons, xrefs: 0040A9C9

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 02117A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02117A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02117ACD
GetLengthSid.ADVAPI32(?), ref: 02117ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02117B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02117B1F
EqualSid.ADVAPI32(?,?), ref: 02117B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 02117B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02117B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02117B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02117B77
LocalFree.KERNEL32(00000000), ref: 02117B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02117B9A
GetAce.ADVAPI32(?,?,?), ref: 02117BCA
EqualSid.ADVAPI32(?,?), ref: 02117BF1
DeleteAce.ADVAPI32(?,?), ref: 02117C0A
EqualSid.ADVAPI32(?,?), ref: 02117C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 02117CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02117CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02117CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02117CE0
LocalFree.KERNEL32(00000000), ref: 02117CEE

Strings

D, xrefs: 02117AC3

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 5a11677dd3c85ad7b3143c76904d567348eb541fb547e28b5de58cd20f423a34
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 20814D7194021EAFDB21CFA4DD84FEEFBB8AF08304F14807AE515E6290D7759682CB64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

Iphlpapi.dll, xrefs: 004019B7
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3
123.45.67.89, xrefs: 004019A6
GetBestInterface, xrefs: 004019EF
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 0211858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0211865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0211867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 021186A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 021186B1

Strings

PromptOnSecureDesktop, xrefs: 021185B6, 02118645, 021186BD, 02118708, 021187C5, 02118812, 021188E9, 02118905
", xrefs: 0211896C

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 8b0f43a4cb7df1068df41915be87caf1b8df0e445546388eb78585e3bb5b31b1
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: A9C180B298024DBEFB11ABA4DD84EEF7BBDEB04304F158076F604E6050E7B14A95CB65

Function 021114E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02111601
lstrlenW.KERNEL32(-00000003), ref: 021117D8

Strings

D, xrefs: 0211182D
, xrefs: 021116C9
<, xrefs: 021115DF
@, xrefs: 021115E7

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: bb3494c23ade77732a3fa984f461aaf3a5501cd07dfdff4acaa14d017d61697e
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 97F19BB1548345AFD720CF64C888BAAFBE5FB89304F00893DF69A97390D7B49944CB56

Function 02117666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 021176D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02117757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0211778F
___ascii_stricmp.LIBCMT ref: 021178B4
RegCloseKey.ADVAPI32(?), ref: 0211794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0211796D
RegCloseKey.ADVAPI32(?), ref: 0211797E
RegCloseKey.ADVAPI32(?), ref: 021179AC
RegCloseKey.ADVAPI32(?), ref: 02117A56

Part of subcall function 0211F40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,0211772A,?), ref: 0211F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 021179F6
RegCloseKey.ADVAPI32(?), ref: 02117A4D

Strings

PromptOnSecureDesktop, xrefs: 021176C5, 021176CA, 021176E5, 02117782, 021177E6, 02117862, 0211787B, 021179C2
", xrefs: 02117800

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: bf4f03007374c572a31eab37934ddf3c783a9372a32533073f763af889c03ec7
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: D3C18371980259AFEB119FA4DC44FEEBBBAEF49310F1440B5E504E6290EB719A85CB60

Function 02112CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02112CED
socket.WS2_32(00000002,00000002,00000011), ref: 02112D07
htons.WS2_32(00000000), ref: 02112D42
select.WS2_32 ref: 02112D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 02112DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02112E62

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 18c8a4d240f5242d44ddb80f624d2cc27cfd2fd958ea3d98e4d33b9098e68a3e
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 17612371944329AFC7209F64DC08BABBBF8FB88745F114829FD8897150D7B5D880CBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_MID, xrefs: 0040AEAE
%s%d, xrefs: 0040AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_HST, xrefs: 0040AEC5
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0211958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 021195A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 021195D5
GetModuleFileNameA.KERNEL32(00000000), ref: 021195DC
wsprintfA.USER32 ref: 02119635
wsprintfA.USER32 ref: 02119673
wsprintfA.USER32 ref: 021196F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02119758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0211978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 021197D8

Strings

PromptOnSecureDesktop, xrefs: 02119604, 02119624, 02119662, 02119683, 021196B6, 021196DF, 02119701, 02119734, 02119780, 021197B7

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: a6eefa88b6990bb88f83fac7d43d349ccd4df375857031b8b060df06346c2f76
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: F5A17AB298021CAFEB21DFA0DC55FDA3BADAF04740F104036FA25A6151E7B5D584CFA4

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
86A, xrefs: 0040BF98
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
06A, xrefs: 0040BF70

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_USER, xrefs: 0040B488
%FROM_EMAIL, xrefs: 0040B3E9
%TO_DOMAIN, xrefs: 0040B44B
%s@%s, xrefs: 0040B461
%TO_HASH, xrefs: 0040B4B0
%FROM_USER, xrefs: 0040B431
%DATE, xrefs: 0040B4D2
%TO_EMAIL, xrefs: 0040B473
%FROM_DOMAIN, xrefs: 0040B41E
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 02111FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0211202D
GetSystemInfo.KERNEL32(?), ref: 0211204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 0211206A
GetProcAddress.KERNEL32(00000000), ref: 02112071
GetCurrentProcess.KERNEL32(?), ref: 02112082
GetTickCount.KERNEL32 ref: 02112230

Part of subcall function 02111E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 02111E7C

Strings

flags_upd, xrefs: 021120A5, 021120AA, 021120E3
hi_id, xrefs: 0211217D, 02112182, 0211219A
localcfg, xrefs: 02112091, 02112098, 021120AB, 021120E4, 021120F3, 02112119, 02112138, 0211214E, 02112166, 02112183, 0211219B, 021121B7, 021121D7
work_srv, xrefs: 021120C5

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: e4536f2b713a8083d0c74e1900197b967647b149d88a40dca1872c7be1c30be3
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: BF51A4B0584348AFE330AF759C85F6BBAECEB45704F00493DFD9A82142D7B9A584CB65

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 02113059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02113068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02113078
GetProcAddress.KERNEL32(00000000,00410408), ref: 02113095
RtlAllocateHeap.NTDLL(00000000), ref: 021130B6
htons.WS2_32(00000035), ref: 021130EF
inet_addr.WS2_32(?), ref: 021130FA
gethostbyname.WS2_32(?), ref: 0211310D
HeapFree.KERNEL32(00000000), ref: 0211314D

Strings

iphlpapi.dll, xrefs: 02113062, 02113067, 02113077

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 09e5bc238644634283621fdcf1ba7c2213b126a001b061382a7024b7a3138cee
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: FB31E831A40706ABDF119BB89C48BAE7BB8EF05364F1441B5F928E32D4DB74D941CB58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 02116778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 021167C3
htonl.WS2_32(?), ref: 021167DF
htonl.WS2_32(?), ref: 021167EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 021168F1
ExitProcess.KERNEL32 ref: 021169BC

Strings

except_info, xrefs: 0211698F
localcfg, xrefs: 02116994

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: ab1c98b078e450a9ef7aba094bec2ee6ee20633ccee4bed8bdd1cb82b65f9d0a
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: C4616E71A40208AFDB609FB4DC45FEA77E9FB08300F14806AFA6DD2161EB759990CF54

Function 0211F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0211CC84), ref: 0211F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0211F5CE
closesocket.WS2_32(00000000), ref: 0211F5DC

Strings

time_cfg, xrefs: 0211F58A

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 24dc360c9e807cb2185880de8b3bd182d116ba95a2cf0cf44208fd732b7ac229
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 94316BB2940218ABDB10DFA5DC889EE7BBCEF88310F114566F915D3150E7708A82CBE4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 02112F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02112FA1
LoadLibraryA.KERNEL32(?), ref: 02112FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02112FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02113000
RtlAllocateHeap.NTDLL(00000000), ref: 02113007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02113032

Strings

dnsapi.dll, xrefs: 02112F90

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: ed424b154117ef4f780252bfcc0ffe660aaadd3e209ca99cad413e6f5fb0f528
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 4A217171D8162ABBCB219B55DC48AEEBBBCEF08B50F004471F915E7140D7B49A8187E4

Function 02116F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\slknjncf,02117043), ref: 02116F4E
GetProcAddress.KERNEL32(00000000), ref: 02116F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02116F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02116F92

Strings

\\.\pipe\slknjncf, xrefs: 02116F37
PromptOnSecureDesktop, xrefs: 02116F9D, 02116FBF, 02116FCF, 02116FE5, 02116FF5
C:\Windows\SysWOW64\, xrefs: 02116F30, 02116F38, 02116F65, 02116F6C, 02116F7A, 02116F85, 02116F91, 02116FA9, 02116FC6, 02116FEC

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\slknjncf
API String ID: 1082366364-1174970947
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: f9fc1bf7b74666a5a4c08ca7ca5f020773a48652831ec8949f1a5e8727e36620
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: C721CF217C13917EF72257319C88FBB2A4D8B52764F1880B5F844E65D0EBFA84D682AD

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 021192CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 021192E2
wsprintfA.USER32 ref: 02119350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02119375
lstrlen.KERNEL32(?,?,00000000), ref: 02119389
WriteFile.KERNEL32(00000000,?,00000000), ref: 02119394
CloseHandle.KERNEL32(00000000), ref: 0211939B

Strings

PromptOnSecureDesktop, xrefs: 0211932B, 02119343, 0211935E

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: fe60e77b524ca238f9ea20aa62e8f13c66ac0b61b70ef991b1697743ac0af2be
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: A41142B5A802147FE7246B71EC0DFEF3A6EDBC9B11F008075BB19E5090EBB44A558A64

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 021199E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02119A18
GetThreadContext.KERNEL32(?,?), ref: 02119A52
TerminateProcess.KERNEL32(?,00000000), ref: 02119A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02119A98
SetThreadContext.KERNEL32(?,00010002), ref: 02119AB5
ResumeThread.KERNEL32(?), ref: 02119AC2

Strings

D, xrefs: 02119A10

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 4985ab0ea22c422999c698da581c13f9ae816438fc71977e50a91ea7ad8b6c17
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 61213BB1E41229BBDB119BA1DC09EEFBBBCEF04750F404071BA19E1090E7758A44CBA4

Function 02111C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02111C18
LoadLibraryA.KERNEL32(004102C8), ref: 02111C26
GetProcessHeap.KERNEL32 ref: 02111C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02111C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02111CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 02111D02
FreeLibrary.KERNEL32(?), ref: 02111D0B

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 0798d870c67d8f4ba796db34a11e341e195b149263edcfe0065e226fa60b7ac4
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 36317C32E40209BFCF119FA4DC8C9EEFAB9EB45311B24407AE609A2110DBB54E80DB95

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 02116CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02116CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02116D22
GetLastError.KERNEL32 ref: 02116DA7
CloseHandle.KERNEL32(?), ref: 02116DB5
GetLastError.KERNEL32 ref: 02116DD6
DeleteFileA.KERNEL32(?), ref: 02116DE7
GetLastError.KERNEL32 ref: 02116DFD

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 24a3ff1d4b7369510b83789b6e3c9476924a82645cf307021001db9ab6dc78ab
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 5231F072941289BFCF01DFE49D48ADE7F7EEB48300F148175E691E3210D7728A858B61

Function 021193AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 021193C6
GetModuleFileNameA.KERNEL32(00000000), ref: 021193CD
CharToOemA.USER32(?,?), ref: 021193DB
wsprintfA.USER32 ref: 02119410

Part of subcall function 021192CB: GetTempPathA.KERNEL32(00000400,?), ref: 021192E2
Part of subcall function 021192CB: wsprintfA.USER32 ref: 02119350
Part of subcall function 021192CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02119375
Part of subcall function 021192CB: lstrlen.KERNEL32(?,?,00000000), ref: 02119389
Part of subcall function 021192CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 02119394
Part of subcall function 021192CB: CloseHandle.KERNEL32(00000000), ref: 0211939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02119448

Strings

PromptOnSecureDesktop, xrefs: 021193FA, 021193FF, 0211941C

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 9b50427ccb5f6c0c7dcde37c2640e38327e8040ee4370f9f1138422defada56b
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: E1015EF69401587BDB21A7A19D89EDF3B7CDB95701F0040B2BB49E2080EBB496C58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 0211AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0211AAE5

Strings

, xrefs: 0211ABB3
localcfg, xrefs: 0211AD72

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 305a89ae52afd04c26ae7b22bfa1e221615364faf4d89ec3a1d3ab093bd199e4
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: C3712871AC5348AADF318B54DC85FEE3F6AAF01719F244036F904A6090EF7295C4CB59

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0211E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0211DF6C: GetCurrentThreadId.KERNEL32 ref: 0211DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0211E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02116128), ref: 0211E950
lstrcmp.KERNEL32(?,00000008), ref: 0211E989

Strings

A, xrefs: 0211E9A0
A, xrefs: 0211E960, 0211E965
A, xrefs: 0211E8C6, 0211E8CD, 0211E936, 0211E998

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 3214e9baade64a8d833af09ae005d935350ac2b9148c888c93dbc00066441403
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 28319E31A8071A9FDF758FA4C884BAA7BE8EB05724F10893AE95587554E370E880CB91

Function 02116E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02116E19

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 403608243e60941c3241e87a28aec1e335d3874d0e14a0e309ae188d467b6681
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 3C219072146115FFDB149BB0FC48EDF3FADDB48265B218535F502D1090EB71DA009674

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 0211C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0211C6B4
InterlockedIncrement.KERNEL32(0211C74B), ref: 0211C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0211C747), ref: 0211C728
CloseHandle.KERNEL32(00000000,?,0211C747,00413588,02118A77), ref: 0211C733

Strings

localcfg, xrefs: 0211C544

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: dc0261ebe9041dce56b2c0f2f3c2e064a60d35b16e4005de8678d2e5338a219b
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: D5514DB1A81B418FD7648F69C5D462ABBE9FB48304B50693FE18BC7B90D774E440CB91

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0211E2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0211E50A,00000000,00000000,00000000,00020106,00000000,0211E50A,00000000,000000E4), ref: 0211E319
RegSetValueExA.ADVAPI32(0211E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0211E38E
RegDeleteValueA.ADVAPI32(0211E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0211E3BF
RegCloseKey.ADVAPI32(0211E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0211E50A), ref: 0211E3C8

Strings

PromptOnSecureDesktop, xrefs: 0211E33A

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 85b21dc2360638dfec968806f8ceadea4e0c8354c89ace2467421c025694a492
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: E0212971A40219ABDB209FA5EC89EEF7F69EF08760F048071E905E6160E7718A55DBA0

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 021171C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 021171E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02117228
LocalFree.KERNEL32(?,?,?), ref: 02117286
wsprintfA.USER32 ref: 0211729D

Strings

|, xrefs: 0211721A

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 955527549d04b45e9423f79f80a1c4fa324c2c9b23116f573ec1f667d6641df8
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 62312972A40208BFDB01DFA8DC45BDA7BACEF04314F14C066F959DB240EB75D6498B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0211B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0211B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0211B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0211B548
GetTimeZoneInformation.KERNEL32(?), ref: 0211B590
wsprintfA.USER32 ref: 0211B61E

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 77e761f3dc0e7bcee362c433fd65df9100416afdfac0cea8af93e91fcb25c52f
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 705100B1D4021DAACF58DFD5D8885EEBBB9BF48304F10816AF505B6150E7B84AC9CF98

Function 021162D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 02116303
LoadLibraryA.KERNEL32(?), ref: 0211632A
GetProcAddress.KERNEL32(00000000,?), ref: 021163B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 02116405

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 4a2b8b4f19e5a092cd852781486dd0649e60d30020d7abb988c026a49e10dd06
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 5F415971A50249EFDB14CF58C884BAEB7B8EF04358F198179E869D7290E772E941CB90

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0211E795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0211DF6C: GetCurrentThreadId.KERNEL32 ref: 0211DFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0211A6AC), ref: 0211E7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0211A6AC), ref: 0211E7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0211A6AC), ref: 0211E819

Strings

PromptOnSecureDesktop, xrefs: 0211E840, 0211E845, 0211E87C, 0211E89B

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: b36c7586f844b4e0cb524a2bbbe8758b72f46330e9c553c354eabfb5e69b2c2f
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 3921D3B1A803107EE22077A1AC05FAB3E5DDF65B60F140438FE09A51D2FBB5D5508AB5

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 02117665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 021176D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0211796D
RegCloseKey.ADVAPI32(?), ref: 0211797E

Strings

PromptOnSecureDesktop, xrefs: 021176C5, 021176CA, 021176E5

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 0f958bc3ccd77a0737fc51d33825aa86f0c0effddbfd14cec4378468c636fe9b
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: CB11CA70A80209AFEB128FA9AC44EAFBB79AB91314F140165F514E62D0E3B08941CBA0

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 02119966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0211999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 021199BD
RegCloseKey.ADVAPI32(?), ref: 021199C6

Strings

PromptOnSecureDesktop, xrefs: 02119989, 0211998E, 021199B0, 021199D3

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 5ac6ebf0f2cffb62b0e3e5a390e1df4b7e86fb9e27533644fa211cecd9cbd685
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: AEF0F6B2680218BFF7106B90EC06FDB3A2DDB94B10F100070FA05B5081F7F59A9086B9

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 021128EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 021128FA
gethostbyname.WS2_32(u6A), ref: 02112906

Strings

time_cfg, xrefs: 021128EB
u6A, xrefs: 021128EC, 021128F9, 02112905

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 24a383a197850e8cb8ca4a7f2ede52c2438982db4286e563ad80a97fcb5738a7
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: B7E0C7306042318FCB008F2CF848ACA3BE4EF0A230F0081A4F880C32A0C734DCC0AB91

Function 021169C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 021169E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 02116A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 02116A3A
CloseHandle.KERNEL32(000000FF), ref: 02116BD8

Part of subcall function 0211EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02111DCF,?), ref: 0211EEA8
Part of subcall function 0211EE95: HeapFree.KERNEL32(00000000), ref: 0211EEAF

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 6ea4aa32cc91b056074d79b22ddd41ba9ffbc3abcb67c6c67480e3bb64f4c418
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: E071297194025DEFDF20DFA4CC80AEEBBB9FB04358F10857AE915A6190D7319E92CB64

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0211417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 021141AB
GetLastError.KERNEL32 ref: 021141B5
WaitForSingleObject.KERNEL32(?,?), ref: 021141C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 021141D9

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: db58ba61548bee03f1e00bd70add9e56f41375ed9f83632625069503e33b575f
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: DE01257691111AABDF12DF94ED84BEE3BACEB18759F008061F901F2050D770AA618BB6

Function 021141F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0211421F
GetLastError.KERNEL32 ref: 02114229
WaitForSingleObject.KERNEL32(?,?), ref: 0211423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0211424D

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 7235b0a77e26a1e14b37692d25d91790ef232336a40d45c06554179d713a86fa
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: CB01C472951209AFDF01DF90EE84BEF7BACEB08756F108461F901E2050D770EA948BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 0211E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0211E066

Strings

A, xrefs: 0211E07F
A, xrefs: 0211E036
A, xrefs: 0211E037, 0211E03C

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: c20084644a85c9bda6eaa1d17801f6339dd946f3d0988f935589827db67af61e
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: A0F06D327407029BCB20CFA5D884A82B7E9FF09325B448A3AE958C3060D374A4D8CB51

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 00417746 Relevance: 6.0, APIs: 4, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

CreateJobObjectW.KERNEL32(00000000,00000000), ref: 0041775D
OpenJobObjectW.KERNEL32(00000000,00000000,00000000), ref: 0041777A
BuildCommDCBW.KERNEL32(00000000,?), ref: 00417785
LoadLibraryA.KERNEL32(00000000), ref: 0041778C

Memory Dump Source

Source File: 00000000.00000002.2150586425.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_SecuriteInfo.jbxd

Similarity

API ID: Object$BuildCommCreateLibraryLoadOpen
String ID:
API String ID: 2043902199-0
Opcode ID: 41d5079eb8e4714b47d2246b00cdcaccaaa861bf5368716e78538d3f36d7b98f
Instruction ID: 095df02e26e998a7a84f1c3eb50187d412f7e49c4adf42353831b328159b4c08
Opcode Fuzzy Hash: 41d5079eb8e4714b47d2246b00cdcaccaaa861bf5368716e78538d3f36d7b98f
Instruction Fuzzy Hash: 5AE06D31406628AB87107B65ED8C8CB7F7CEF0A395B018038F90591151DB385A49CFED

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0211E3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,021144E2,00000000,00000000,00000000), ref: 0211E470
CloseHandle.KERNEL32(00000001,00000003), ref: 0211E484

Part of subcall function 0211E2FC: RegCreateKeyExA.ADVAPI32(80000001,0211E50A,00000000,00000000,00000000,00020106,00000000,0211E50A,00000000,000000E4), ref: 0211E319
Part of subcall function 0211E2FC: RegSetValueExA.ADVAPI32(0211E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0211E38E
Part of subcall function 0211E2FC: RegDeleteValueA.ADVAPI32(0211E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0211E3BF
Part of subcall function 0211E2FC: RegCloseKey.ADVAPI32(0211E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0211E50A), ref: 0211E3C8

Strings

PromptOnSecureDesktop, xrefs: 0211E4F1, 0211E4F6, 0211E537, 0211E561

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 46d33f88eb854a94bf7abb3fef39ece7ad8b8e603bcd0dbca6dcf80c96710ecb
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 3441A4B6D80214BEEB206ED18C46FEB3B6DEF14764F148035FE0994091F7B58650DBA5

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 02118330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 021183C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02118477

Part of subcall function 021169C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 021169E5
Part of subcall function 021169C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 02116A26
Part of subcall function 021169C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 02116A3A

Part of subcall function 0211EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02111DCF,?), ref: 0211EEA8
Part of subcall function 0211EE95: HeapFree.KERNEL32(00000000), ref: 0211EEAF

Strings

PromptOnSecureDesktop, xrefs: 021183B2, 021183B7, 02118483

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 013635da65aede58c4f5ffdb633447762c02b9b6d7ef5ac5ebb590b74948cfc7
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 314182B2981108BFEB20EBA49D81EFF777DEB04344F1584B6E904D7550FBB05A948B64

Function 0211E631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0211E859,00000000,00020119,0211E859,PromptOnSecureDesktop), ref: 0211E64D
RegCloseKey.ADVAPI32(0211E859,?,?,?,?,000000C8,000000E4), ref: 0211E787

Strings

PromptOnSecureDesktop, xrefs: 0211E637

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: b0b08dee227cdcfbaf09ada01cd1024a7d902270e5e04eb4217b069f2fba7e79
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: A941D7B2D4021DBFEF11AFD4DC85EEEBB7AFB04304F144476EA10A6160E3719A559BA0

Function 0211AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0211AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0211B00D

Part of subcall function 0211AF6F: gethostname.WS2_32(?,00000080), ref: 0211AF83
Part of subcall function 0211AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0211AFE6

Part of subcall function 0211331C: gethostname.WS2_32(?,00000080), ref: 0211333F
Part of subcall function 0211331C: gethostbyname.WS2_32(?), ref: 02113349

Part of subcall function 0211AA0A: inet_ntoa.WS2_32(00000000), ref: 0211AA10

Strings

%OUTLOOK_BND_, xrefs: 0211B076, 0211B07B, 0211B0BE, 0211B0DD

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 482a3f37b3acb41e28c684bfdf96fabeac0b14a572efd91a0bffbb3e0e0f099e
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 40412CB294430CAFDB25AFA0DC45EEE3BADFF08304F14442AB92892151EB75E6558F54

Function 02119452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02119536
Sleep.KERNEL32(000001F4), ref: 0211955D

Strings

, xrefs: 021194D9

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: fc036604b763f512676bfc6b59ad8a95d14a5984667321cadcfe4b716acc5f6e
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 0A4126B19883856FFB768B68D8AD7B63FE49B02314F1800F7D4B2A71A2D7B44981C751

Function 0211BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0211B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0211BA3A
InterlockedIncrement.KERNEL32(?), ref: 0211BA94
GetTickCount.KERNEL32 ref: 0211BB79
GetTickCount.KERNEL32 ref: 0211BB99
InterlockedIncrement.KERNEL32(?), ref: 0211BE15
closesocket.WS2_32(00000000), ref: 0211BEB4

Strings

%FROM_EMAIL, xrefs: 0211BC7D

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 3f575ee70dbf5b5ff145685fb6a039762fa040b909a7e5dde7c9599bdea59740
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 40316D71548248DFDF25DFA4DC84AEDB7B9EB48708F20406AFA2482160EB75D785CF54

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 00417600 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(004B0090), ref: 004176CC
GetProcAddress.KERNEL32(00000000,0041D260), ref: 00417709

Strings

, xrefs: 00417652

Memory Dump Source

Source File: 00000000.00000002.2150586425.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID:
API String ID: 1646373207-3916222277
Opcode ID: 0ee48c241e3865e6fe63af5d06c40b519bae7ee708b63501a55aea399d733086
Instruction ID: 7f6e8be651a19b3b842f85655ecd7c60ad803230ea63c21e717a852f1ecd4fcc
Opcode Fuzzy Hash: 0ee48c241e3865e6fe63af5d06c40b519bae7ee708b63501a55aea399d733086
Instruction Fuzzy Hash: 9131516595C3C0DDF301D7A8BC067A33BA19B11B55F1491BADA948B2F1D3FA4544C32E

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 0211709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 021170BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 021170F4

Strings

|, xrefs: 021170E6

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 359dea2a164eed136a14cae33b58cd7c44f7c065539e37a3c447adc982e93904
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 08112AB2944118EBDB11CBE4DC84ADEB7BCAB08305F2441B6E501E6294D7709B89CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 02113189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02112F88: GetModuleHandleA.KERNEL32(?), ref: 02112FA1
Part of subcall function 02112F88: LoadLibraryA.KERNEL32(?), ref: 02112FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 021131DA
HeapFree.KERNEL32(00000000), ref: 021131E1

Memory Dump Source

Source File: 00000000.00000002.2151815463.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Offset: 02110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2110000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 159e28ea9f37958aa06575efc1d035c119e0f4d87c7402e2b5594bbff48fe114
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 40519E7194025AEFCB059F64D884AFAB775FF05304F2441B9ECA6C7214E732DA19CB94

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.2150499402.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2150499402.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: szylttbf.exePID: 6788, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	0%
Total number of Nodes:	1612
Total number of Limit Nodes:	18

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 0040A078
C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
\, xrefs: 00409D0C
jcbeaetw, xrefs: 0040A389, 0040A397
P, xrefs: 00409DAA
", xrefs: 00409EDB
D, xrefs: 00409F8E
%X%08X, xrefs: 0040A0B0
C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 0040A1D9
", xrefs: 0040A189

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe$C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe$D$P$\$jcbeaetw
API String ID: 2089075347-3116346850
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 0041782A Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 212
stringmemorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,00000000), ref: 004178BD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004178CB
WriteConsoleA.KERNEL32(00000000,?,00000000,?,00000000), ref: 004178E2
lstrcpynW.KERNEL32(?,00000000,00000000), ref: 004178F1
GetAtomNameA.KERNEL32(00000000,00000000,00000000), ref: 004178FA
SetFileApisToANSI.KERNEL32 ref: 00417900
SetVolumeMountPointA.KERNEL32(00000000,00000000), ref: 00417908
GetModuleFileNameW.KERNEL32(00000000,?,00000000), ref: 00417917
EnumDateFormatsW.KERNEL32(00000000,00000000,00000000), ref: 00417920
GlobalAlloc.KERNEL32(00000000,00000000), ref: 00417958
AddAtomA.KERNEL32(00000000), ref: 0041795F
GetCommProperties.KERNELBASE(00000000,?), ref: 0041796D
SetLastError.KERNEL32(00000000), ref: 00417974
GetProcessDefaultLayout.USER32(00000000), ref: 00417983
ReleaseActCtx.KERNEL32(00000000), ref: 00417996
GetConsoleAliasesA.KERNEL32(?,00000000,00000000), ref: 004179A5
FoldStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004179C1
SetConsoleTitleA.KERNEL32(00000000), ref: 00417A05
LocalFree.KERNEL32(00000000), ref: 00417A0C
LoadLibraryA.KERNELBASE(00419458), ref: 00417AA0

Strings

tl_, xrefs: 0041789E
k`, xrefs: 00417AB4
}$, xrefs: 00417AC1

Memory Dump Source

Source File: 0000000C.00000002.2220350402.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_szylttbf.jbxd

Similarity

API ID: Console$AtomFileName$AliasesAllocApisCommDateDefaultEnumErrorExchangeFoldFormatsFreeGlobalInterlockedLastLayoutLibraryLoadLocalModuleMountPointProcessPropertiesReleaseStringTitleVolumeWritelstrcatlstrcpyn
String ID: k`$tl_$}$
API String ID: 1756273361-211918992
Opcode ID: 3697615f451d7fc26fb8104d22a62db024d6b7e65e0f42aee9dd171e956c996e
Instruction ID: b72458c26081517cb692f213dc5e595fb7550a1c7ca338c38081d81411803abd
Opcode Fuzzy Hash: 3697615f451d7fc26fb8104d22a62db024d6b7e65e0f42aee9dd171e956c996e
Instruction Fuzzy Hash: 76617E71909524ABD725AB66EC48DDF7F7CEF0A395B10403EF106D2161CB388A85CBAD

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0062003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0062024D

Strings

kernel32.dll, xrefs: 0062008F, 00620095
cess, xrefs: 0062018D

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 42ec4702e70d4e90e99a8a4f860a1c510c2e99c0fd791167ea9c40f41969c617
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: FB526874A01229DFDB64CF58D985BA8BBB1BF09304F1480D9E94DAB352DB30AE85DF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 0040EC54 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Strings

6]*,, xrefs: 0040EC89

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 6]*,
API String ID: 1209300637-3453183305
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 00689786 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006897AE
Module32First.KERNEL32(00000000,00000224), ref: 006897CE

Memory Dump Source

Source File: 0000000C.00000002.2221208662.0000000000688000.00000040.00000020.00020000.00000000.sdmp, Offset: 00688000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_688000_szylttbf.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 508f58dbad769f6589ca7e1bceeacf823e06bda97a27c21d0365b35e30fc9f00
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 95F062312107116FD7203EB59C8DABA76EAAF49765F180628F646915C0DA70E8454B71

Function 00620E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00620223,?,?), ref: 00620E19
SetErrorMode.KERNELBASE(00000000,?,?,00620223,?,?), ref: 00620E1E

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ca7d39d3f00bb23aeb65542139c9111eb9232972a72a4ee517b453a7e7f206fa
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: FCD0123114512877D7002A94DC09BCD7B1CDF05B62F008411FB0DD9581C770994046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 004175E2 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 004175F8

Memory Dump Source

Source File: 0000000C.00000002.2220350402.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_szylttbf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4e90e5151ba5019126abd3050a43543751f9b5068c80efb2043434d2877197fe
Instruction ID: aa73c9f825d5df17848c24f377238b424e705aacf1c0d2419f86f1d3d7c4eb2b
Opcode Fuzzy Hash: 4e90e5151ba5019126abd3050a43543751f9b5068c80efb2043434d2877197fe
Instruction Fuzzy Hash: ABC08CB1200209BFCB018B85FC01E863B6CE305384F004071F302A00B0C2B2E9049B1C

Function 00689445 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00689496

Memory Dump Source

Source File: 0000000C.00000002.2221208662.0000000000688000.00000040.00000020.00020000.00000000.sdmp, Offset: 00688000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_688000_szylttbf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ecfbeb44421eae7784e3f23dfe3067b76a79be5e84463f8f237ffb1e0bdc6953
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: F0113C79A00208EFDB01DF98C985E98BBF5AF08350F098094F9489B362D375EA50DF90

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Function 004175C3 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,00417A4D), ref: 004175CB

Memory Dump Source

Source File: 0000000C.00000002.2220350402.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_szylttbf.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 1b8ec44056b00309cc5f266c182984128dcf6dbdfddfd59655b0be00dbed23e0
Instruction ID: 274654774a60fdf00fd51e05caba7627b891178c4aca089a58273a46cc3454b5
Opcode Fuzzy Hash: 1b8ec44056b00309cc5f266c182984128dcf6dbdfddfd59655b0be00dbed23e0
Instruction Fuzzy Hash: CFB011B00002008FCB800FA8EC08B023EA2A30A383F028038E200882B0CBB20008AF2A

Non-executed Functions

Function 006265E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006265F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00626610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 00626631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00626652

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 6e8d70b919d2912a5f2b723aa750023fdc702aba04b80f35724d9e53374ef877
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 21115171600629BFDB219F65EC46F9B3FA9EB057A5F104024F908A7251D6B1DD408BA4

Function 00629EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00629E6D
lstrcpy.KERNEL32(?,00000000), ref: 00629FE1
lstrcat.KERNEL32(?,?), ref: 00629FF2
lstrcat.KERNEL32(?,0041070C), ref: 0062A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0062A054
DeleteFileA.KERNEL32(?), ref: 0062A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0062A0D6
lstrcpy.KERNEL32 ref: 0062A12F
lstrlen.KERNEL32(00000022), ref: 0062A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 00629F13

Part of subcall function 00627029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 00627081

Part of subcall function 00626F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\slknjncf,00627043), ref: 00626F4E
Part of subcall function 00626F30: GetProcAddress.KERNEL32(00000000), ref: 00626F55
Part of subcall function 00626F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00626F7B
Part of subcall function 00626F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00626F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0062A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0062A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0062A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0062A21B
GetDriveTypeA.KERNEL32(?), ref: 0062A265
lstrcat.KERNEL32(?,00000000), ref: 0062A29F
lstrcat.KERNEL32(?,00410A34), ref: 0062A2C5
lstrcat.KERNEL32(?,00000022), ref: 0062A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0062A2F4
wsprintfA.USER32 ref: 0062A31D
lstrcat.KERNEL32(?,00000000), ref: 0062A345
lstrcat.KERNEL32(?,?), ref: 0062A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0062A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0062A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0062A1D1

Part of subcall function 00629966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0062999D
Part of subcall function 00629966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 006299BD
Part of subcall function 00629966: RegCloseKey.ADVAPI32(?), ref: 006299C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0062A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0062A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0062A41D

Strings

P, xrefs: 0062A011
", xrefs: 0062A3F0
", xrefs: 0062A2DF
D, xrefs: 0062A1F5
\, xrefs: 00629F73
", xrefs: 0062A142

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: cf56528590d5de3b35cdf00c70cbdd8fe06b47d3e27ef0900399007fdd1af3bf
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 66F164B1C40669AFDF11DBA0DC49EEF77BDAB08304F0484A9F605E2141E7B58A858F65

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtDuplicateToken, xrefs: 004011F3
RtlNtStatusToDosError, xrefs: 00401194
NtTerminateProcess, xrefs: 004010F6
RtlInitUnicodeString, xrefs: 00401135
NtClose, xrefs: 004011B4
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlLengthSid, xrefs: 00401246
NtSetInformationToken, xrefs: 00401175
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlSetLastWin32Error, xrefs: 004010D6
ntdll.dll, xrefs: 0040100D
NtSetInformationThread, xrefs: 00401155
NtFilterToken, xrefs: 0040122B
NtOpenProcessToken, xrefs: 004011D4
RtlFreeSid, xrefs: 00401116
NtQueryInformationToken, xrefs: 00401262

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Mon, xrefs: 0040B22C
Apr, xrefs: 0040B26B
Nov, xrefs: 0040B29C
Thu, xrefs: 0040B241
Oct, xrefs: 0040B295
Sat, xrefs: 0040B24F
Aug, xrefs: 0040B287
Sep, xrefs: 0040B28E
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Mar, xrefs: 0040B264
Wed, xrefs: 0040B23A
Fri, xrefs: 0040B248
Jan, xrefs: 0040B256
Feb, xrefs: 0040B25D
Tue, xrefs: 0040B233
Jun, xrefs: 0040B279
Dec, xrefs: 0040B2A3
May, xrefs: 0040B272
Jul, xrefs: 0040B280
Sun, xrefs: 0040B225

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00627CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00627D21
GetUserNameA.ADVAPI32(?,?), ref: 00627D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00627D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00627DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00627DC0
EqualSid.ADVAPI32(?,?), ref: 00627DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 00627DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00627DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00627E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00627E12
LocalFree.KERNEL32(00000000), ref: 00627E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00627E35

Strings

C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 00627F49, 00627F76, 00627F8A, 00627F8B
D, xrefs: 00627D73

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe$D
API String ID: 2976863881-36158169
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 4ee8455aea944f6e348c348989476da7ec125704da033bd804ab694877bc2556
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 40A14E71904229AFDB11CFA1ED88FEEBBB9FB08300F148069E545E6250DB759A85CF64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe$D
API String ID: 2976863881-36158169
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

va=%08X%08X uef=%p, xrefs: 00406595
except_info, xrefs: 00406728
%d=%p, xrefs: 004066F9
Jan 13 2018, xrefs: 0040653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
plgs:, xrefs: 004066AA
12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Too big smtp respons (%d bytes), xrefs: 0040A9B1
Incorrect respons, xrefs: 0040AB39
helo %s, xrefs: 0040A803
data, xrefs: 0040A85E
rcpt to:<%s>, xrefs: 0040A855
quit, xrefs: 0040A86C
ESMTP, xrefs: 0040AA38
mail from:<%s>, xrefs: 0040A848
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
., xrefs: 0040A8CA
AUTH LOGIN, xrefs: 0040A80C
Too small respons, xrefs: 0040A9C9
localcfg, xrefs: 0040AB0B
ehlo %s, xrefs: 0040A7F5

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00627A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00627A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00627ACD
GetLengthSid.ADVAPI32(?), ref: 00627ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00627B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00627B1F
EqualSid.ADVAPI32(?,?), ref: 00627B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 00627B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00627B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00627B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00627B77
LocalFree.KERNEL32(00000000), ref: 00627B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00627B9A
GetAce.ADVAPI32(?,?,?), ref: 00627BCA
EqualSid.ADVAPI32(?,?), ref: 00627BF1
DeleteAce.ADVAPI32(?,?), ref: 00627C0A
EqualSid.ADVAPI32(?,?), ref: 00627C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 00627CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00627CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00627CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00627CE0
LocalFree.KERNEL32(00000000), ref: 00627CEE

Strings

D, xrefs: 00627AC3

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: b5ce8a3a4ae40f99efbe3a6cbc28d3f08216b5d2ec21349f88c41ca726efae05
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 68815F71A04529AFDB11CFA5ED44FEEBBB9FF08344F04806AE905E6250D7758A41CF64

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe$localcfg
API String ID: 237177642-1740763546
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

@, xrefs: 00401380
<, xrefs: 00401378
uac, xrefs: 00401628
D, xrefs: 004015C6
, xrefs: 00401462
wusa.exe, xrefs: 00401388
PDGu, xrefs: 0040139A
useless, xrefs: 0040161E
%systemroot%\system32\cmd.exe, xrefs: 00401316

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
loader_id, xrefs: 00401F4B, 00401F6B
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
lid_file_upd, xrefs: 00401E25
net_type, xrefs: 00401E87
born_date, xrefs: 00401EAD, 00401ECC
IsWow64Process, xrefs: 00401DF2
start_srv, xrefs: 00401E6C
kernel32, xrefs: 00401DF7
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
work_srv, xrefs: 00401E5E

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
GetIfEntry, xrefs: 004019E4
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC
Iphlpapi.dll, xrefs: 004019B7
localcfg, xrefs: 004019A3

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 0062858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0062865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0062867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 006286A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 006286B1

Strings

C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 0062882F, 0062883C, 0062884C
", xrefs: 0062896C

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe
API String ID: 237177642-3421264840
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: bb9cd6a8c4855096fda7845a832955f2fc2a96d1cd444fe238c86e16bd6177f2
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 9CC1B271901569BEEB11ABA4EC85EEF7BBEEB04300F148079F600E3151EB714E948F69

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 006214E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00621601
lstrlenW.KERNEL32(-00000003), ref: 006217D8

Strings

D, xrefs: 0062182D
<, xrefs: 006215DF
, xrefs: 006216C9
@, xrefs: 006215E7

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: a4b322177bc98c8980436d08bef61a021a3fd0c9a70b9b65288de346579b8ba8
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: BBF1BCB15087519FD320CF64D888BABB7E6FB9A300F00892DF5969B390D7B49984CF56

Function 00627666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006276D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00627757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0062778F
___ascii_stricmp.LIBCMT ref: 006278B4
RegCloseKey.ADVAPI32(?), ref: 0062794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0062796D
RegCloseKey.ADVAPI32(?), ref: 0062797E
RegCloseKey.ADVAPI32(?), ref: 006279AC
RegCloseKey.ADVAPI32(?), ref: 00627A56

Part of subcall function 0062F40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,0062772A,?), ref: 0062F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 006279F6
RegCloseKey.ADVAPI32(?), ref: 00627A4D

Strings

", xrefs: 00627800

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 83735ac5c7da22fe29131c49766629ad1e1653eeb0f2054f61f5d97f8725deab
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 23C1D271904A29AFEB11DFA4EC45FEE7BBAEF05310F1040A5F504E6291EB719E848F64

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 00622CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00622CED
socket.WS2_32(00000002,00000002,00000011), ref: 00622D07
htons.WS2_32(00000000), ref: 00622D42
select.WS2_32 ref: 00622D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 00622DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00622E62

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: d51e7a7e90dd00393f942240da859fb13d96ab061227e900b54a7a6fbeec7256
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: AA61F371504726BBC320AF60EC08BABBBF9FF88741F154819F98497251D7B5D8809FA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_MID, xrefs: 0040AEAE

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_HASH, xrefs: 0040B4B0
%FROM_EMAIL, xrefs: 0040B3E9
%TO_EMAIL, xrefs: 0040B473
%DATE, xrefs: 0040B4D2
%s@%s, xrefs: 0040B461
%FROM_USER, xrefs: 0040B431
%FROM_DOMAIN, xrefs: 0040B41E
%TO_USER, xrefs: 0040B488
%TO_DOMAIN, xrefs: 0040B44B
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00621FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0062202D
GetSystemInfo.KERNEL32(?), ref: 0062204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 0062206A
GetProcAddress.KERNEL32(00000000), ref: 00622071
GetCurrentProcess.KERNEL32(?), ref: 00622082
GetTickCount.KERNEL32 ref: 00622230

Part of subcall function 00621E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 00621E7C

Strings

flags_upd, xrefs: 006220A5, 006220AA, 006220E3
work_srv, xrefs: 006220C5
localcfg, xrefs: 00622091, 00622098, 006220AB, 006220E4, 006220F3, 00622119, 00622138, 0062214E, 00622166, 00622183, 0062219B, 006221B7, 006221D7
hi_id, xrefs: 0062217D, 00622182, 0062219A

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 85dcd30d0fa18f37179991f568de312c07edd71a64c600f7b0bb721043a81fe1
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 28512BB0500B54AFE370AF75AC86F677AEDEF54704F00092DF99642242D7B59940CB69

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 00623059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00623068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00623078
GetProcAddress.KERNEL32(00000000,00410408), ref: 00623095
RtlAllocateHeap.NTDLL(00000000), ref: 006230B6
htons.WS2_32(00000035), ref: 006230EF
inet_addr.WS2_32(?), ref: 006230FA
gethostbyname.WS2_32(?), ref: 0062310D
HeapFree.KERNEL32(00000000), ref: 0062314D

Strings

iphlpapi.dll, xrefs: 00623062, 00623067, 00623077

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 1d813b30b10a32134a73d01bf1cdc8a9fba1a703c76f177ae71f5f5a84f58c3c
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: B731A731A00B36ABDB119BB4AC4CAEE7779EF04760F144125E518E7390DB78DE518F58

Function 0062958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 006295A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006295D5
GetModuleFileNameA.KERNEL32(00000000), ref: 006295DC
wsprintfA.USER32 ref: 00629635
wsprintfA.USER32 ref: 00629673
wsprintfA.USER32 ref: 006296F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00629758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0062978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006297D8

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 361d2385f7301a4bba166a64323ee31d45b51f5de95e021051f3b75b0c9b7882
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 88A19FB190062CBFEB21DFA0EC45FDA3BAEEB44340F10402AF90596251E775C984CFA5

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 00626778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 006267C3
htonl.WS2_32(?), ref: 006267DF
htonl.WS2_32(?), ref: 006267EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 006268F1
ExitProcess.KERNEL32 ref: 006269BC

Strings

except_info, xrefs: 0062698F
localcfg, xrefs: 00626994

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: db483c27ba6bba87460c7183fcfba4bfefb2bee3526782cbccefdfabb1a506b3
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: DF617E71A40218AFDB609FB4DC45FEA77E9FB08300F24806AFA6DD2161EA7599908F14

Function 0062F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0062CC84), ref: 0062F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0062F5CE
closesocket.WS2_32(00000000), ref: 0062F5DC

Strings

time_cfg, xrefs: 0062F58A

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: c5cec7c0f91004e46711342e5653f4d8a75e21fa0a27a917be8ef5dd7389a7d6
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 4B318B72900528ABDB109FA5EC89DEE7BBDEF89350F10417AF905E3150E7708A858FA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 00622F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00622FA1
LoadLibraryA.KERNEL32(?), ref: 00622FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00622FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00623000
RtlAllocateHeap.NTDLL(00000000), ref: 00623007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 00623032

Strings

dnsapi.dll, xrefs: 00622F90

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 354b11c558ed6c659a592cc63cbef45475a121ebfb5d32476dbbf2e1e94c06da
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 25213271941A36BBCB219B55EC449EEBBB9FF18B50F104421F905E7240D7B49E818BE4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 006299E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00629A18
GetThreadContext.KERNEL32(?,?), ref: 00629A52
TerminateProcess.KERNEL32(?,00000000), ref: 00629A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00629A98
SetThreadContext.KERNEL32(?,00010002), ref: 00629AB5
ResumeThread.KERNEL32(?), ref: 00629AC2

Strings

D, xrefs: 00629A10

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: e820f12697ed6b59226f73d94d03bf4cfe893f97a55acd81fc621d2ebe196282
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 1D212AB1E01229BBDB119BA1EC09EEF7BBDEF04750F404061BA19E1150EB758A44CFA4

Function 00621C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00621C18
LoadLibraryA.KERNEL32(004102C8), ref: 00621C26
GetProcessHeap.KERNEL32 ref: 00621C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00621C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00621CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 00621D02
FreeLibrary.KERNEL32(?), ref: 00621D0B

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: f60f28010b81c4ed7d146f9c18b747f3b19b22b5d12448dab16aabe85fca0cb8
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 69315235E04229FFCB119FA4EC888EEBAB6EF56301B24447AE501A6210D7B54D80DF54

Function 00626CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00626CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00626D22
GetLastError.KERNEL32 ref: 00626DA7
CloseHandle.KERNEL32(?), ref: 00626DB5
GetLastError.KERNEL32 ref: 00626DD6
DeleteFileA.KERNEL32(?), ref: 00626DE7
GetLastError.KERNEL32 ref: 00626DFD

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 4cac3b3c8dfdab0e4e102bc681a89b1d953bd73f8fe53c6a48de5b7a03e287ac
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: E431FF76A0065DBFCB019FA4ED44ADEBF7AEF48300F148465F211E3261D7709A458F65

Function 00626F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\slknjncf,00627043), ref: 00626F4E
GetProcAddress.KERNEL32(00000000), ref: 00626F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00626F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00626F92

Strings

C:\Windows\SysWOW64\, xrefs: 00626F30, 00626F38, 00626F65, 00626F6C, 00626F7A, 00626F85, 00626F91, 00626FA9, 00626FC6, 00626FEC
\\.\pipe\slknjncf, xrefs: 00626F37

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\slknjncf
API String ID: 1082366364-2134968345
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: ca369a0b3592c72e381bc044ed5946f55819fa3d1f900e87aa69b25753be2071
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 59216871744B6079F7225731BD8DFFB2E5E8B12710F0880A9F800D5281DAD988DA8BAD

Function 0062AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0062AAE5

Strings

localcfg, xrefs: 0062AD72
, xrefs: 0062ABB3

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 4c0adcb3a3e837be03467dc8cd9055ff9ba6dfdeea5f421156e973fcd4c1fc98
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 81710971A00B35ABDF218BD4FC85BEE376B9F00705F244876F904A6191DAE19D848F5B

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0062E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062DF6C: GetCurrentThreadId.KERNEL32 ref: 0062DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0062E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00626128), ref: 0062E950
lstrcmp.KERNEL32(?,00000008), ref: 0062E989

Strings

A, xrefs: 0062E9A0
A, xrefs: 0062E960, 0062E965
A, xrefs: 0062E8C6, 0062E8CD, 0062E936, 0062E998

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 2d22d5c6ba729824f750cd5985f6d9305eb32a546d9189f9d34b7d3557d569ff
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 4D31B031A00B259BDB718F24E884BE67BE6EB15720F10853BE59587651D376E8C0CF85

Function 00626E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00626E19

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: edf2acbfa7e2910c7c44fd43cf45ca21678e068ce979f2e5ab41688197600ea0
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: EB215E76109525BFDB109B70FC49EDF3FAEDB49360B228425F542D1091EB71DA409B78

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 006292CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 006292E2
wsprintfA.USER32 ref: 00629350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00629375
lstrlen.KERNEL32(?,?,00000000), ref: 00629389
WriteFile.KERNEL32(00000000,?,00000000), ref: 00629394
CloseHandle.KERNEL32(00000000), ref: 0062939B

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 58b190df47b656413c4b63c768ebf5d1a1e684644d127f0491593526ed3a6a63
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 061187B17405247BE7606731ED0EFEF3A6EDBC4B10F00C079BB05E5095EEB54A458A68

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 0062C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0062C6B4
InterlockedIncrement.KERNEL32(0062C74B), ref: 0062C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0062C747), ref: 0062C728
CloseHandle.KERNEL32(00000000,?,0062C747,00413588,00628A77), ref: 0062C733

Strings

localcfg, xrefs: 0062C544

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 1924bca72225357bc4002720a05a7cd7b605b78e75f3cd1e872ccfac3ae271bf
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 1D5169B1A00B518FC7648F69DAC462ABBEAFB48310B50593EE58BC7A90D774F840CF14

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe
API String ID: 124786226-2476057647
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0062E2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0062E50A,00000000,00000000,00000000,00020106,00000000,0062E50A,00000000,000000E4), ref: 0062E319
RegSetValueExA.ADVAPI32(0062E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0062E38E
RegDeleteValueA.ADVAPI32(0062E50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Db), ref: 0062E3BF
RegCloseKey.ADVAPI32(0062E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Db,0062E50A), ref: 0062E3C8

Strings

Db, xrefs: 0062E2FC

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: Db
API String ID: 2667537340-3549961961
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 413b329a591ff06ba9cbab78379d25b37acce342010e278c7df40c012f1ede8c
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 52213E71A0022DBBDF209FA5EC89EDE7F7AEF09750F048075F904E6151E6728A54DBA0

Function 006271C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006271E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00627228
LocalFree.KERNEL32(?,?,?), ref: 00627286
wsprintfA.USER32 ref: 0062729D

Strings

|, xrefs: 0062721A

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: d590bff9bf45c7e99aa70b99ee7c6ca27f8a6818c04f4936b86d87b3be652eef
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 97312B72904219BBDB01DFA4EC49EDA3BBDEF04354F148066F859DB201EA75D7488F94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 0062B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0062B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0062B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0062B548
GetTimeZoneInformation.KERNEL32(?), ref: 0062B590
wsprintfA.USER32 ref: 0062B61E

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 70b442295583a50f5d29c5ef1cc53c5768f3c7a72f7adb07ed2c58335025befa
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 8251FFB1D0021DAACF14DFD5D8895EEBBB9EF48304F10816AE505B6150E7B94AC9CF98

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 006262D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 00626303
LoadLibraryA.KERNEL32(?), ref: 0062632A
GetProcAddress.KERNEL32(00000000,?), ref: 006263B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 00626405

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 3344bde8fbfc94aeffa7bf396d1285803e50aed1570ee3161105af62a3e6d24d
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 61415A71A00A29EBDB14CF58E884AA9B7BAFF04354F248169F855D7390E771ED41CF90

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 006293AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006293C6
GetModuleFileNameA.KERNEL32(00000000), ref: 006293CD
CharToOemA.USER32(?,?), ref: 006293DB
wsprintfA.USER32 ref: 00629410

Part of subcall function 006292CB: GetTempPathA.KERNEL32(00000400,?), ref: 006292E2
Part of subcall function 006292CB: wsprintfA.USER32 ref: 00629350
Part of subcall function 006292CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00629375
Part of subcall function 006292CB: lstrlen.KERNEL32(?,?,00000000), ref: 00629389
Part of subcall function 006292CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 00629394
Part of subcall function 006292CB: CloseHandle.KERNEL32(00000000), ref: 0062939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00629448

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 2cfb44c89ffc5e169543a50f41db7fc89273b7313e1741efa0361d08f2171a3c
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 850192F69005287BD720A7619D49EDF377CDB85701F0040A5BB09E2080DAB49BC58F75

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 0062EEBB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0062EEC5
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0062EED9
GetTickCount.KERNEL32 ref: 0062EEDF

Strings

6]*,, xrefs: 0062EEF0

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 6]*,
API String ID: 1209300637-3453183305
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 006228EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 006228FA
gethostbyname.WS2_32(u6A), ref: 00622906

Strings

time_cfg, xrefs: 006228EB
u6A, xrefs: 006228EC, 006228F9, 00622905

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: e69c8d9bc13b7e13145835170578520d13663a59e3728188cd3a212926d4661f
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 63E01230604922AFDB509B2CF848AD677E6EF4A330F458595F454D72A0C778DCC19B54

Function 006269C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 006269E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 00626A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 00626A3A
CloseHandle.KERNEL32(000000FF), ref: 00626BD8

Part of subcall function 0062EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00621DCF,?), ref: 0062EEA8
Part of subcall function 0062EE95: HeapFree.KERNEL32(00000000), ref: 0062EEAF

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: fe18c1b0cc8a375c4f2f882bbdee66ca67398af16faed58e54507f5127caf153
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: CF710671D00629EFDB109FA4DC809EEBBBAFB04315F1045AAF515E6290D7309E92DF50

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 0062417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006241AB
GetLastError.KERNEL32 ref: 006241B5
WaitForSingleObject.KERNEL32(?,?), ref: 006241C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006241D9

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: ba74b553c6f05fa99d626f210380ebff7640525b801ed2135155ff2506547ae7
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 7201E97651111AABDF01DF90ED88BEE7B6DEB18355F104061F901E2150DB709AA48FB5

Function 006241F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0062421F
GetLastError.KERNEL32 ref: 00624229
WaitForSingleObject.KERNEL32(?,?), ref: 0062423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0062424D

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 4d6155d4aa5b7197d8b9472ce9998c32c9756ecf53fa069f740af7058cc9c53c
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: E801E57291251AABDF02DF91EE84BEE7BADEB08355F108061F901E2150DB709A548FB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 0062E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0062E066

Strings

A, xrefs: 0062E07F
A, xrefs: 0062E036
A, xrefs: 0062E037, 0062E03C

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: ff6e0a761e86794fb533a8cb3306c5980447db65139e3d822af80b11174fa807
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 78F06831600B119BCB20CF15E8849C2B7EAFB15321B44863BE154C7160D3B5A8A5CF51

Function 00417746 Relevance: 6.0, APIs: 4, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

CreateJobObjectW.KERNEL32(00000000,00000000), ref: 0041775D
OpenJobObjectW.KERNEL32(00000000,00000000,00000000), ref: 0041777A
BuildCommDCBW.KERNEL32(00000000,?), ref: 00417785
LoadLibraryA.KERNEL32(00000000), ref: 0041778C

Memory Dump Source

Source File: 0000000C.00000002.2220350402.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_szylttbf.jbxd

Similarity

API ID: Object$BuildCommCreateLibraryLoadOpen
String ID:
API String ID: 2043902199-0
Opcode ID: 41d5079eb8e4714b47d2246b00cdcaccaaa861bf5368716e78538d3f36d7b98f
Instruction ID: 095df02e26e998a7a84f1c3eb50187d412f7e49c4adf42353831b328159b4c08
Opcode Fuzzy Hash: 41d5079eb8e4714b47d2246b00cdcaccaaa861bf5368716e78538d3f36d7b98f
Instruction Fuzzy Hash: 5AE06D31406628AB87107B65ED8C8CB7F7CEF0A395B018038F90591151DB385A49CFED

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0062E3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,Db,00000000,00000000,00000000), ref: 0062E470
CloseHandle.KERNEL32(00000001,00000003), ref: 0062E484

Part of subcall function 0062E2FC: RegCreateKeyExA.ADVAPI32(80000001,0062E50A,00000000,00000000,00000000,00020106,00000000,0062E50A,00000000,000000E4), ref: 0062E319
Part of subcall function 0062E2FC: RegSetValueExA.ADVAPI32(0062E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0062E38E
Part of subcall function 0062E2FC: RegDeleteValueA.ADVAPI32(0062E50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Db), ref: 0062E3BF
Part of subcall function 0062E2FC: RegCloseKey.ADVAPI32(0062E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Db,0062E50A), ref: 0062E3C8

Strings

Db, xrefs: 0062E498, 0062E4BD, 0062E41A, 0062E447, 0062E4C0, 0062E41D, 0062E459, 0062E45A, 0062E46C, 0062E49B

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: Db
API String ID: 4151426672-3549961961
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 53f6600335a8a1e9890643ca8790cc688379316ab9bfe115c10526e9e8591008
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 6741CD71D00624BAEB20AF51AC46FDB3B6DDB04764F148039F909A4192E7B6CA50DEB5

Function 00628330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 006283C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00628477

Part of subcall function 006269C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 006269E5
Part of subcall function 006269C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 00626A26
Part of subcall function 006269C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 00626A3A

Part of subcall function 0062EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00621DCF,?), ref: 0062EEA8
Part of subcall function 0062EE95: HeapFree.KERNEL32(00000000), ref: 0062EEAF

Strings

C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 0062848C, 006284A1

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe
API String ID: 359188348-2476057647
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 3394d3cc52e3d70d1faad01938fe2dc854ae849ff6eb55124a24540ba6711e90
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 154181B290252ABFEB10EBA0AD81DFF77AEEB04340F14447AF504D7151EAB15A948F64

Function 0062AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0062AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0062B00D

Part of subcall function 0062AF6F: gethostname.WS2_32(?,00000080), ref: 0062AF83
Part of subcall function 0062AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0062AFE6

Part of subcall function 0062331C: gethostname.WS2_32(?,00000080), ref: 0062333F
Part of subcall function 0062331C: gethostbyname.WS2_32(?), ref: 00623349

Part of subcall function 0062AA0A: inet_ntoa.WS2_32(00000000), ref: 0062AA10

Strings

%OUTLOOK_BND_, xrefs: 0062B076, 0062B07B, 0062B0BE, 0062B0DD

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 7ce1813298ec273132b70ec7078a4754031352e71827dde3c37f58b645ae7b0c
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 6D41517290061CABDB25EFA0EC46EEF3B6DFF08304F14442AF92492152EB75D6548F58

Function 00629452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 00629536
Sleep.KERNEL32(000001F4), ref: 0062955D

Strings

, xrefs: 006294D9

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 11e5ef0bf84b98340819868852affe335ad7ce76ce9c06ac2cf0331c9c19b132
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 90413771E047A56EFB339B24F89C7F63BE69B82314F1440A5D482A7292D6744D82CF31

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 0062BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0062B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0062BA3A
InterlockedIncrement.KERNEL32(?), ref: 0062BA94
GetTickCount.KERNEL32 ref: 0062BB79
GetTickCount.KERNEL32 ref: 0062BB99
InterlockedIncrement.KERNEL32(?), ref: 0062BE15
closesocket.WS2_32(00000000), ref: 0062BEB4

Strings

%FROM_EMAIL, xrefs: 0062BC7D

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 57e6c3f11443a9bad53163ab54ed6bd871def994fb057f1e94ba4b17399d185b
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 5031DF71400A58DFDF24DFA4EC84AED77BAEF48300F20846AFA6492261DB70DA85CF14

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 00417600 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(004B0090), ref: 004176CC
GetProcAddress.KERNEL32(00000000,0041D260), ref: 00417709

Strings

, xrefs: 00417652

Memory Dump Source

Source File: 0000000C.00000002.2220350402.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_szylttbf.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID:
API String ID: 1646373207-3916222277
Opcode ID: 0ee48c241e3865e6fe63af5d06c40b519bae7ee708b63501a55aea399d733086
Instruction ID: 7f6e8be651a19b3b842f85655ecd7c60ad803230ea63c21e717a852f1ecd4fcc
Opcode Fuzzy Hash: 0ee48c241e3865e6fe63af5d06c40b519bae7ee708b63501a55aea399d733086
Instruction Fuzzy Hash: 9131516595C3C0DDF301D7A8BC067A33BA19B11B55F1491BADA948B2F1D3FA4544C32E

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 0062709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006270BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 006270F4

Strings

|, xrefs: 006270E6

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: c2bd94d1ef7643e2bd39515755acb7f7a860ceebc4222d79a82c1ba6f46f97db
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: F811FA72904538EBDF11CBD4EC88EDFB7BEAF05711F1841A6E501E6190D6709B989FA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00623189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00622F88: GetModuleHandleA.KERNEL32(?), ref: 00622FA1
Part of subcall function 00622F88: LoadLibraryA.KERNEL32(?), ref: 00622FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 006231DA
HeapFree.KERNEL32(00000000), ref: 006231E1

Memory Dump Source

Source File: 0000000C.00000002.2220998578.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_szylttbf.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 3348a83084be362aafdad686c780dbc9d5ac078bdcc4fbb9a747c94338faf09a
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 6251AA3190066AEFCB01DF64E8889EAB776FF15300B2441A8EC9687311E736DB59CF94

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.2220329703.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_szylttbf.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: svchost.exePID: 6548, Parent PID: 6788COMMON

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 0275C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0275CA4E
closesocket.WS2_32(?), ref: 0275CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0275CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0275CCB4
WriteFile.KERNEL32(0275A4B3,?,-000000E8,?,00000000), ref: 0275CCDC
CloseHandle.KERNEL32(0275A4B3), ref: 0275CCED
wsprintfA.USER32 ref: 0275CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0275CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0275CD89
CloseHandle.KERNEL32(?), ref: 0275CD98
CloseHandle.KERNEL32(?), ref: 0275CD9D
DeleteFileA.KERNEL32(?), ref: 0275CDC4
CloseHandle.KERNEL32(0275A4B3), ref: 0275CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0275CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0275CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0275D033
lstrcatA.KERNEL32(?,03F00108), ref: 0275D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0275D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0275D171
WriteFile.KERNEL32(00000000,03F0012C,?,?,00000000), ref: 0275D195
CloseHandle.KERNEL32(00000000), ref: 0275D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0275D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0275D231
lstrcatA.KERNEL32(?,03F00108,?,?,?,?,?,?,?,00000100), ref: 0275D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0275D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0275D2C7
WriteFile.KERNEL32(00000000,03F0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0275D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0275D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0275D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0275D372
lstrcatA.KERNEL32(?,03F00108,?,?,?,?,?,?,?,00000100), ref: 0275D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0275D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0275D408
WriteFile.KERNEL32(00000000,03F0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0275D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0275D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0275D45B
CreateProcessA.KERNEL32(?,02760264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0275D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0275D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0275D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0275D513
closesocket.WS2_32(?), ref: 0275D56C
Sleep.KERNEL32(000003E8), ref: 0275D577
ExitProcess.KERNEL32 ref: 0275D583
wsprintfA.USER32 ref: 0275D81F

Part of subcall function 0275C65C: send.WS2_32(00000000,?,00000000), ref: 0275C74B

closesocket.WS2_32(?), ref: 0275DAD5

Strings

srv_time, xrefs: 0275CABB
\, xrefs: 0275D39D
.sys, xrefs: 0275D0CC
wtm_w, xrefs: 0275C96C
wtm_r, xrefs: 0275C97F
@, xrefs: 0275D754
.dat, xrefs: 0275D0D7, 0275D138, 0275D1AE, 0275D1D4, 0275D28E, 0275D308, 0275D3CF, 0275D441
except_info, xrefs: 0275D8CD, 0275D8D2, 0275D8FB
local_time, xrefs: 0275CACD
work_srv, xrefs: 0275D607, 0275D60F, 0275D62C
4, xrefs: 0275D9F7
C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 0275CC10, 0275CCF3, 0275D975, 0275D98E
localcfg, xrefs: 0275CA89, 0275CA93, 0275CAC0, 0275CAD2, 0275CE4F, 0275CE6F, 0275D8D3, 0275D8FC
\, xrefs: 0275D3A7
flags_upd, xrefs: 0275CE4A
drivers\, xrefs: 0275D067
wtm_c, xrefs: 0275C956
lid_file_upd, xrefs: 0275CE6A
time_cfg, xrefs: 0275C95B, 0275C962, 0275C971, 0275C984

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-2997293747
Opcode ID: fca6085f95f29f16319078b979f44f754f4aaa0ffd707bc77574c1e80aee95a5
Instruction ID: ad3f4e5ddd65128e335fa362812eec06455460ec9ea93ca3bb9c284da21317be
Opcode Fuzzy Hash: fca6085f95f29f16319078b979f44f754f4aaa0ffd707bc77574c1e80aee95a5
Instruction Fuzzy Hash: C2B2C4B2D40329AFEB229FA4DD4DFEEBBB9EB05304F04446AED05A6140D7B09A55CF50

Function 02759A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02759A7F
SetErrorMode.KERNELBASE(00000003), ref: 02759A83
SetUnhandledExceptionFilter.KERNEL32(02756511), ref: 02759A8A

Part of subcall function 0275EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0275EC5E
Part of subcall function 0275EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0275EC72
Part of subcall function 0275EC54: GetTickCount.KERNEL32 ref: 0275EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02759AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02759ABA
GetCommandLineA.KERNEL32 ref: 02759AFD
lstrlenA.KERNEL32(?), ref: 02759B99
ExitProcess.KERNEL32 ref: 02759C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02759CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02759D7A
lstrcatA.KERNEL32(?,?), ref: 02759D8B
lstrcatA.KERNEL32(?,0276070C), ref: 02759D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02759DED
DeleteFileA.KERNEL32(00000022), ref: 02759E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02759E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02759EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02759ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02759F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02759F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02759F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02759FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02759FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02759FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0275A038
lstrcatA.KERNEL32(00000022,02760A34), ref: 0275A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0275A072
lstrcatA.KERNEL32(00000022,02760A34), ref: 0275A08D
wsprintfA.USER32 ref: 0275A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0275A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0275A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0275A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0275A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0275A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0275A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0275A1B6
GetCommandLineA.KERNEL32 ref: 0275A1E5

Part of subcall function 027599D2: lstrcpyA.KERNEL32(?,?,00000100,027622F8,00000000,?,02759E9D,?,00000022,?,?,?,?,?,?,?), ref: 027599DF
Part of subcall function 027599D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02759E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02759A3C
Part of subcall function 027599D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02759E9D,?,00000022,?,?,?), ref: 02759A52

lstrlenA.KERNEL32(?), ref: 0275A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0275A3B7
GetLastError.KERNEL32 ref: 0275A3ED
Sleep.KERNEL32(000003E8), ref: 0275A400
DeleteFileA.KERNELBASE(027633D8), ref: 0275A407
CreateThread.KERNELBASE(00000000,00000000,0275405E,00000000,00000000,00000000), ref: 0275A42C
WSAStartup.WS2_32(00001010,?), ref: 0275A43A
CreateThread.KERNELBASE(00000000,00000000,0275877E,00000000,00000000,00000000), ref: 0275A469
Sleep.KERNELBASE(00000BB8), ref: 0275A48A
GetTickCount.KERNEL32 ref: 0275A49F
GetTickCount.KERNEL32 ref: 0275A4B7
Sleep.KERNELBASE(00001A90), ref: 0275A4C3

Strings

C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 0275A1D9
D, xrefs: 02759F8E
jcbeaetw, xrefs: 0275A389, 0275A397
%X%08X, xrefs: 0275A0B0
P, xrefs: 02759DAA
", xrefs: 0275A189
", xrefs: 02759EDB
", xrefs: 0275A078
\, xrefs: 02759D0C

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe$D$P$\$jcbeaetw
API String ID: 2089075347-2075815589
Opcode ID: 3049e8fde86c4b78e52d790792fcee9d6b7fd6a65c012ebb1db66de43c9c20af
Instruction ID: b08388ce32216ae52e1ea68f9d751d384698afec4c69cebbce6c774f26f6cbbe
Opcode Fuzzy Hash: 3049e8fde86c4b78e52d790792fcee9d6b7fd6a65c012ebb1db66de43c9c20af
Instruction Fuzzy Hash: 585264B1D40369EFDF129BA4CC4DEEEBBBDBB04304F1445A5EA09E2141E7B19A448F61

Function 0275199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 027519B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02751E9E), ref: 027519BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 027519E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 027519ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 027519F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02751E9E), ref: 02751A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02751E9E), ref: 02751A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02751E9E), ref: 02751A36
GetAdaptersInfo.IPHLPAPI(00000000,02751E9E,?,?,?,?,00000001,02751E9E), ref: 02751A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02751E9E,?,?,?,?,00000001,02751E9E), ref: 02751A5A
GetAdaptersInfo.IPHLPAPI(00000000,02751E9E,?,?,?,?,00000001,02751E9E), ref: 02751A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02751E9E), ref: 02751A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02751E9E), ref: 02751AA4

Strings

GetBestInterface, xrefs: 027519EF
localcfg, xrefs: 027519A3
123.45.67.89, xrefs: 027519A6
Iphlpapi.dll, xrefs: 027519B7
GetIfEntry, xrefs: 027519E4
GetAdaptersInfo, xrefs: 027519DC

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 3b9a14642817a1f801beb607184c7c8d02513b9813f0ba3fcf42720777083a28
Instruction ID: c982e97bfb088ffb0ef796ae5587d2a917896f653ed7919897dc601014b9cf0d
Opcode Fuzzy Hash: 3b9a14642817a1f801beb607184c7c8d02513b9813f0ba3fcf42720777083a28
Instruction Fuzzy Hash: 33314172D40269AFDB129FE4CC8CABEFBB5FF45616B544969F905A2100D7B04E40CBA4

Function 02757A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02757ABA
GetUserNameA.ADVAPI32(?,?), ref: 02757ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0276070C,?,?,?), ref: 02757B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02757B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02757B59
EqualSid.ADVAPI32(?,00000022), ref: 02757B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02757B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02757B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02757B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02757BAB
LocalFree.KERNEL32(00000000), ref: 02757BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02757FC9,?,00000000), ref: 02757BCE

Strings

C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 02757CE2, 02757D0F, 02757D23, 02757D24
D, xrefs: 02757B0C

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe$D
API String ID: 2976863881-36158169
Opcode ID: 9a451131bbc4e0af53f93cd42a67bece9fa875e7b4148d8cee331cf653d36b9f
Instruction ID: c251eda07d9b20dcd3cd8ec6b022eb96ed1e1cb8eb8ff0f8b01b6b35ffe40160
Opcode Fuzzy Hash: 9a451131bbc4e0af53f93cd42a67bece9fa875e7b4148d8cee331cf653d36b9f
Instruction Fuzzy Hash: 41A13AB1E40229AFEF159FA1DC88EEEFBBDFB44304F048469E905E2140E7759A55CB60

Function 02757809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0275782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02757866
GetLengthSid.ADVAPI32(?), ref: 02757878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0275789A
GetSecurityDescriptorOwner.ADVAPI32(?,02757F63,?), ref: 027578B8
EqualSid.ADVAPI32(?,02757F63), ref: 027578D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 027578E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 027578F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02757901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02757910
LocalFree.KERNEL32(00000000), ref: 02757917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02757933
GetAce.ADVAPI32(?,00000000,?), ref: 02757963
EqualSid.ADVAPI32(?,02757F63), ref: 0275798A
DeleteAce.ADVAPI32(?,00000000), ref: 027579A3
EqualSid.ADVAPI32(?,02757F63), ref: 027579C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02757A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02757A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02757A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02757A79
LocalFree.KERNEL32(00000000), ref: 02757A87

Strings

D, xrefs: 0275785C

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 99f947808959be8f80bedc7f46024cc6771522da5d3fb9c9ec9d80b2754c0fe3
Instruction ID: 0108fbef21307461fa7c49aed5623d047aef8c927475a174d092b0925dc153dc
Opcode Fuzzy Hash: 99f947808959be8f80bedc7f46024cc6771522da5d3fb9c9ec9d80b2754c0fe3
Instruction Fuzzy Hash: 8B813A71D0022AABDB25CFA4CD48FEEFBB8BF08344F14856AE905E2140D7759A55CBA4

Function 02758328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,02760750,?,?,00000000,localcfg,00000000), ref: 027583F3
RegQueryValueExA.KERNELBASE(02760750,?,00000000,?,02758893,?,?,?,00000000,00000103,02760750,?,?,00000000,localcfg,00000000), ref: 02758414
RegSetValueExA.KERNELBASE(02760750,?,00000000,00000004,02758893,00000004,?,?,00000000,00000103,02760750,?,?,00000000,localcfg,00000000), ref: 02758441
RegCloseKey.ADVAPI32(02760750,?,?,00000000,00000103,02760750,?,?,00000000,localcfg,00000000), ref: 0275844A

Strings

C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 027585C8, 027585D5, 027585E5
localcfg, xrefs: 02758348

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe$localcfg
API String ID: 237177642-1740763546
Opcode ID: fd497a92c3d4486ef87c990851e0c57e368b0763f9e2eaf62485c17d3e8ea8c4
Instruction ID: 2d840a0e4c4819e14e764590964603cd4bead38a07f5a4a18bc948da04fe68c4
Opcode Fuzzy Hash: fd497a92c3d4486ef87c990851e0c57e368b0763f9e2eaf62485c17d3e8ea8c4
Instruction Fuzzy Hash: CAC185B1D40269BFEB129FA4DC89EFEBBBDEB04304F144865ED05A6041E7B14A94CF61

Function 02751D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02751DC6
GetSystemInfo.KERNELBASE(?), ref: 02751DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02751E03
GetProcAddress.KERNEL32(00000000), ref: 02751E0A
GetCurrentProcess.KERNEL32(?), ref: 02751E1B
GetTickCount.KERNEL32 ref: 02751FC9

Part of subcall function 02751BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02751C15

Strings

start_srv, xrefs: 02751E6C
born_date, xrefs: 02751EAD, 02751ECC
localcfg, xrefs: 02751E2A, 02751E31, 02751E44, 02751E7D, 02751E8C, 02751EB2, 02751ED1, 02751EE7, 02751EFF, 02751F1C, 02751F34, 02751F50, 02751F70
kernel32, xrefs: 02751DF7
hi_id, xrefs: 02751F16, 02751F1B, 02751F33
flags_upd, xrefs: 02751E3E, 02751E43, 02751E7C
IsWow64Process, xrefs: 02751DF2
loader_id, xrefs: 02751F4B, 02751F6B
lid_file_upd, xrefs: 02751E25
work_srv, xrefs: 02751E5E
net_type, xrefs: 02751E87

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: fce1416994b4d88a28576d3ab0f43d510063114c1cb3c61583376079f4207cff
Instruction ID: d779f70245df8123690da7a11e87a7ec2c2b9ebaa13a9414de7c4b71cf45e0da
Opcode Fuzzy Hash: fce1416994b4d88a28576d3ab0f43d510063114c1cb3c61583376079f4207cff
Instruction Fuzzy Hash: 6E51A0B09083546FE321AB768C8DF2BFAECFB45709F44491DFD5A92142D7F4A9048BA1

Function 027573FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 02757472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 027574F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 02757528
___ascii_stricmp.LIBCMT ref: 0275764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 027576E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02757706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 02757717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 02757745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 027577EF

Part of subcall function 0275F1A5: lstrlenA.KERNEL32(000000C8,000000E4,027622F8,000000C8,02757150,?), ref: 0275F1AD

GetFileAttributesExA.KERNELBASE(00000022,00000000,?), ref: 0275778F
RegCloseKey.KERNELBASE(?), ref: 027577E6

Strings

", xrefs: 02757599

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 93ce9d556c1714b35201afe043d44693dab2313135428c1842f189d7af469dec
Instruction ID: cefd2789bc888b9a0dd2a1429a5d5921c81cd31602d8721e743c5e94d1115a52
Opcode Fuzzy Hash: 93ce9d556c1714b35201afe043d44693dab2313135428c1842f189d7af469dec
Instruction Fuzzy Hash: B2C18171900229AFEB169FA4DC48FEEFBBAEF45310F140495ED04E6190EBB19A54CF60

Function 0275675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0275677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0275679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 027567B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 027567BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 027567D3
ReadFile.KERNELBASE(000000FF,?,00000040,02758244,00000000,?,75920F10,00000000), ref: 02756807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0275681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0275683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0275685C
ReadFile.KERNEL32(000000FF,?,00000028,02758244,00000000,?,75920F10,00000000), ref: 0275688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 02756906
ReadFile.KERNEL32(000000FF,?,00000000,02758244,00000000,?,75920F10,00000000), ref: 0275691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,75920F10,00000000), ref: 02756971

Part of subcall function 0275EC2E: GetProcessHeap.KERNEL32(00000000,0275EA27,00000000,0275EA27,00000000), ref: 0275EC41
Part of subcall function 0275EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0275EC48

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: cbacdf52b7442a435969f86d950369b55c0daaf89e7d5d9c21a706a168bbd659
Instruction ID: e4cc40c4bb3f6b80da643a8f9be84900c4ae816d5f4a32a6c462d71a0dac6ecb
Opcode Fuzzy Hash: cbacdf52b7442a435969f86d950369b55c0daaf89e7d5d9c21a706a168bbd659
Instruction Fuzzy Hash: 6B7126B1C0022DEFDF158FA4CC84AEEBBB9FB04314F50456AE915A6190E7709E92CF60

Function 0275F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(0275CA1D), ref: 0275F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0275F367
closesocket.WS2_32(00000000), ref: 0275F375

Strings

time_cfg, xrefs: 0275F323

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: a6306034e22988f1517560cc596a5e326ecfbf7128acf1e1be2c1b5a6bed4eba
Instruction ID: c0f7baa2428b8aba674048027b055ee736465715b1b857769b784b4b6ae3d1f5
Opcode Fuzzy Hash: a6306034e22988f1517560cc596a5e326ecfbf7128acf1e1be2c1b5a6bed4eba
Instruction Fuzzy Hash: 50317C72940228AFDB11DFA4DC889EFBBBCFF89310F104566F915E3140E7B09A418BA1

Function 0275405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02754070
ExitProcess.KERNEL32 ref: 02754121

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 1bb8202f906360d8ff969a0ba42f9fd981d9ee4ec3de58196be958a4c05531e7
Instruction ID: 5223c3fe734a2e95b086aeef39f8f2b4310fb1b0fc2b3dba90623b066d2fd87d
Opcode Fuzzy Hash: 1bb8202f906360d8ff969a0ba42f9fd981d9ee4ec3de58196be958a4c05531e7
Instruction Fuzzy Hash: EE5170B1D40229BAEB21ABA09C49FBFBA7DEB11754F104455FE14B60C0E7B18A41CBA1

Function 02752D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,02752F01,?,027520FF,02762000), ref: 02752D3A
LoadLibraryA.KERNEL32(?), ref: 02752D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02752D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02752D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02752D99
HeapAlloc.KERNEL32(00000000), ref: 02752DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02752DCB

Strings

DnsQuery_A, xrefs: 02752D5B
dnsapi.dll, xrefs: 02752D29

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: 336a46de4754bbf8ccb49ad55c51aa13a69c03acd7e306465a78f0cd7e605566
Instruction ID: a75f023a2f4c3866f6a720f54ddc4dc67db6cd0286c9690be140614d3d4311a8
Opcode Fuzzy Hash: 336a46de4754bbf8ccb49ad55c51aa13a69c03acd7e306465a78f0cd7e605566
Instruction Fuzzy Hash: B6214A71940326BBCB229B66DC48AAEFBB8FF08B51F104416FD05A7101D7B0AA858BD0

Function 027580C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0275815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0275A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02758187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0275A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 027581BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02758210

Part of subcall function 0275675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0275677E
Part of subcall function 0275675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0275679A
Part of subcall function 0275675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 027567B0
Part of subcall function 0275675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 027567BF
Part of subcall function 0275675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 027567D3
Part of subcall function 0275675C: ReadFile.KERNELBASE(000000FF,?,00000040,02758244,00000000,?,75920F10,00000000), ref: 02756807
Part of subcall function 0275675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0275681F
Part of subcall function 0275675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0275683E
Part of subcall function 0275675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0275685C

Part of subcall function 0275EC2E: GetProcessHeap.KERNEL32(00000000,0275EA27,00000000,0275EA27,00000000), ref: 0275EC41
Part of subcall function 0275EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0275EC48

Strings

C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe, xrefs: 02758225, 0275823A

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe
API String ID: 124786226-2476057647
Opcode ID: ba80dede7627304399e9ba028b50efc163be837b1a1b4d3b3da8c457f5c70aed
Instruction ID: fc46e75b663c4f9e42906e56da5b308b528f3dde28c40ff65f4a545fa19d5179
Opcode Fuzzy Hash: ba80dede7627304399e9ba028b50efc163be837b1a1b4d3b3da8c457f5c70aed
Instruction Fuzzy Hash: 474198B1D45269BFEB51EB90DD88DBFFB7DAB04304F04486AED05E2001E7B15E948B51

Function 02751AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02751AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02751AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02751B20

Strings

GetAdaptersAddresses, xrefs: 02751AE3
Iphlpapi.dll, xrefs: 02751ACC

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 97c2b32ac3cff513633909f5957f14cfdb4de0c971bfedc9f1bb9a490a7659ea
Instruction ID: d77a3000306fd851f57796a7a375880fa00f714ad5bddedd86e6d60ee4f173c3
Opcode Fuzzy Hash: 97c2b32ac3cff513633909f5957f14cfdb4de0c971bfedc9f1bb9a490a7659ea
Instruction Fuzzy Hash: E311E971E01538BFDB15DBA8CC88DEDFBBAEB44B12B954055E809E7100E7B04E40CB90

Function 0275E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,0275E5F2,00000000,00020119,0275E5F2,027622F8), ref: 0275E3E6
RegQueryValueExA.ADVAPI32(0275E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0275E44E
RegQueryValueExA.ADVAPI32(0275E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0275E482
RegQueryValueExA.ADVAPI32(0275E5F2,?,00000000,?,80000001,?), ref: 0275E4CF
RegCloseKey.ADVAPI32(0275E5F2,?,?,?,?,000000C8,000000E4), ref: 0275E520

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 25affffe3b97ebfa69b0505ffc3859c61d043c9dc3f35b4292c90394fac936b5
Instruction ID: c41406d8e9565497a608c0fbd6b0c43140edceaac63526839eea0a6bda4b71af
Opcode Fuzzy Hash: 25affffe3b97ebfa69b0505ffc3859c61d043c9dc3f35b4292c90394fac936b5
Instruction Fuzzy Hash: F941E8B2D0022DAFEF119FD4DC84DEEBBBDFB08344F144566EA10A2150E3B19A559FA1

Function 0275F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0275F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0275F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0275F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0275F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0275F2FD

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8de9b12aaf9adec31a036e4e774bcef00bb70f9e9ef3a20c1d18f127f124e3f0
Instruction ID: 06183837faf5a360ba1cfed3ac8f32733f4c96d17fc09061096095c67421dd9e
Opcode Fuzzy Hash: 8de9b12aaf9adec31a036e4e774bcef00bb70f9e9ef3a20c1d18f127f124e3f0
Instruction Fuzzy Hash: 6311FBB1A40248BAEB11DE94CD45F9E7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 02751BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02751AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02751AD4
Part of subcall function 02751AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02751AE9
Part of subcall function 02751AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02751B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02751C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02751C51

Strings

localcfg, xrefs: 02751BE7
hi_id, xrefs: 02751BE5

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 28fad9e5b10bafedc7297e0cf21c72e065331358a4ddaa8d7c66453ce221bd6d
Instruction ID: b4925a93ca4de23f3ce47962e066c9ee6e8678a2af08d56c2eab816126f38ab2
Opcode Fuzzy Hash: 28fad9e5b10bafedc7297e0cf21c72e065331358a4ddaa8d7c66453ce221bd6d
Instruction Fuzzy Hash: 29019672D01128BFEB10DAF8C8C4AFFFBBDE744646F504475EA06E3100D2B09D449660

Function 02751B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02751AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02751AD4
Part of subcall function 02751AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02751AE9
Part of subcall function 02751AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02751B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02751BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02751EFD,00000000,00000000,00000000,00000000), ref: 02751BB8

Strings

localcfg, xrefs: 02751B7B

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 56a380ff6cd725aedddedff30064e9fb452aa51f3f70b567897b148b3fa03e01
Instruction ID: 1ce3e5d4c38e4acc69b5f5c11924b789cfd1b5fd215308dd032b9461378ccf41
Opcode Fuzzy Hash: 56a380ff6cd725aedddedff30064e9fb452aa51f3f70b567897b148b3fa03e01
Instruction Fuzzy Hash: 57014FB6D00118BFEB019AE9C885AEFFABDEB48655F550561AA05F7140D5B05E048AA0

Function 02752684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 02752693
gethostbyname.WS2_32(00000001), ref: 0275269F

Strings

time_cfg, xrefs: 02752684

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 684fc13b4b77c53b6649013a774c374e8a02c8ada323908dd21df6b61d2f6e6a
Instruction ID: b7f63f74f03751fa51c412d6b1b5b7373bc99b485f6f49b374cde58b94099f7e
Opcode Fuzzy Hash: 684fc13b4b77c53b6649013a774c374e8a02c8ada323908dd21df6b61d2f6e6a
Instruction Fuzzy Hash: 94E0C2306041218FDB108F28F448BD6B7E4EF06230F018580FC40C3191C770DC808780

Function 0275E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0275DD05: GetTickCount.KERNEL32 ref: 0275DD0F
Part of subcall function 0275DD05: InterlockedExchange.KERNEL32(027636B4,00000001), ref: 0275DD44
Part of subcall function 0275DD05: GetCurrentThreadId.KERNEL32 ref: 0275DD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,0275A445), ref: 0275E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,75920F10,?,00000000,?,0275A445), ref: 0275E583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,0275A445), ref: 0275E5B2

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: f69457cc9984fa50d08201ef225d3ff98cc3b85f81b748bb9ac423b109b80e83
Instruction ID: 33fea64e70986c9149e40c757cf0b1ca5bb60954738afa3511c945dd23835d97
Opcode Fuzzy Hash: f69457cc9984fa50d08201ef225d3ff98cc3b85f81b748bb9ac423b109b80e83
Instruction Fuzzy Hash: B021B1B2E803207BF6227A219C5EF6BBA1DDB55750F100454FE0EA51D3FAE1DA108AF1

Function 0275877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 027588A5

Part of subcall function 0275F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0275E342,00000000,7508EA50,80000001,00000000,0275E513,?,00000000,00000000,?,000000E4), ref: 0275F089
Part of subcall function 0275F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0275E342,00000000,7508EA50,80000001,00000000,0275E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0275F093

Strings

localcfg, xrefs: 027587CA, 027587CF, 027587FB, 02758835, 02758861
rresolv, xrefs: 027587F6, 0275885C

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 391322323b5bdc21439c26957c33c2fbaaf7b52717f031e995e3139ad4ee4fbe
Instruction ID: 93eaa7fa7945585a61480b04e3c58504afdbeed26165c9b9ab0243793dcd0b65
Opcode Fuzzy Hash: 391322323b5bdc21439c26957c33c2fbaaf7b52717f031e995e3139ad4ee4fbe
Instruction Fuzzy Hash: 06212931A883216FF356B7656C4EFAABAD9EB02724F540819FD08850C2EFF5559049A3

Function 02754000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,027622F8,027542B6,00000000,00000001,027622F8,00000000,?,027598FD), ref: 02754021
GetLastError.KERNEL32(?,027598FD,00000001,00000100,027622F8,0275A3C7), ref: 0275402C
Sleep.KERNEL32(000001F4,?,027598FD,00000001,00000100,027622F8,0275A3C7), ref: 02754046

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: f289152fecbb21b5be4198ba333d3b1b7a665fca248a36205604e9f020305307
Instruction ID: fc63a53c63edc185d59cf3e2a8ce58c2e41e9b74b16f7906f12ce640049c6346
Opcode Fuzzy Hash: f289152fecbb21b5be4198ba333d3b1b7a665fca248a36205604e9f020305307
Instruction Fuzzy Hash: 4FF0A7316402116AD7350F34AC5DBAAB361EF81724F358F64F7B9E20D0C7B044C19B14

Function 0275DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNELBASE(0275DC19,?,00000104), ref: 0275DB7F
lstrcpyA.KERNEL32(?,027628F8), ref: 0275DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 0275DBC2

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: bfc4490a5ffac8cf5c5cf5315b93ff9eb2504c151982d90d795c46610bfa2605
Instruction ID: 0fea60c0082a13334f7dc94009278361d519e245f9f49081047d056d9a31cd4b
Opcode Fuzzy Hash: bfc4490a5ffac8cf5c5cf5315b93ff9eb2504c151982d90d795c46610bfa2605
Instruction Fuzzy Hash: 8DF09AB0540309ABEF21DF64DC89FE97B69BB00308F2089A4FB91A40D0D7F2D595CB20

Function 0275EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0275EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0275EC72
GetTickCount.KERNEL32 ref: 0275EC78

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 71315140a24e91fed5226c603607116795bdf731264b8eb009a655332f7a8efd
Instruction ID: 420ef1d7920420e6705c7f3302b79ea9831ab048a7a5f1096832794834863994
Opcode Fuzzy Hash: 71315140a24e91fed5226c603607116795bdf731264b8eb009a655332f7a8efd
Instruction Fuzzy Hash: 02E09AF5C50204BFEB05ABB0DC4EE6B77BCFB08314F504A50F912D6080DA709A148B60

Function 027530B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 027530D8
gethostbyname.WS2_32(?), ref: 027530E2

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 7f508d2b7d44c333884325ed3b20c1f7a2d4c08c5e00d6f84e32a19fe6cfd06d
Instruction ID: 7560ee5fdce982a1ba13832750a7c0933eadfa54a025b68f6d74a3eb61f082a8
Opcode Fuzzy Hash: 7f508d2b7d44c333884325ed3b20c1f7a2d4c08c5e00d6f84e32a19fe6cfd06d
Instruction Fuzzy Hash: 25E06571D002299FCB009BA8EC89F9B77ACBF04208F084461F905E3250EA74E5048790

Function 0275EBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,7FFF0001,80000001,?,0275DB55,7FFF0001), ref: 0275EC13
RtlReAllocateHeap.NTDLL(00000000,?,0275DB55,7FFF0001), ref: 0275EC1A

Part of subcall function 0275EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0275EBFE,7FFF0001,?,0275DB55,7FFF0001), ref: 0275EBD3
Part of subcall function 0275EBCC: RtlAllocateHeap.NTDLL(00000000,?,0275DB55,7FFF0001), ref: 0275EBDA

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 5d55394599b49b3269ecd20b7d4106ebf03452740c3a2e40a6a264428306e5ad
Instruction ID: 298284ab328f337219a039990729af5e85c3422d7c33a73d300dfe48bbc29f4d
Opcode Fuzzy Hash: 5d55394599b49b3269ecd20b7d4106ebf03452740c3a2e40a6a264428306e5ad
Instruction Fuzzy Hash: E5E012325446287BDF062F94E80CF9D7B9AEB04362F108015FD0D49060CBB186A0DA95

Function 0275EC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0275EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0275EC0A,00000000,80000001,?,0275DB55,7FFF0001), ref: 0275EBAD
Part of subcall function 0275EBA0: HeapSize.KERNEL32(00000000,?,0275DB55,7FFF0001), ref: 0275EBB4

GetProcessHeap.KERNEL32(00000000,0275EA27,00000000,0275EA27,00000000), ref: 0275EC41
RtlFreeHeap.NTDLL(00000000), ref: 0275EC48

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: e57c5892462c9e99c3058e268c39df0360fe0d145bcf360419328cb091170e6c
Instruction ID: 4a79d4b2cfbda76e4903a538037cde6ee132150e604b6c55ecd7f9c3eae35f25
Opcode Fuzzy Hash: e57c5892462c9e99c3058e268c39df0360fe0d145bcf360419328cb091170e6c
Instruction Fuzzy Hash: E4C01232C467306BC5562A50B90CF9FBB59AF46612F094809F805660408BB0994046E1

Function 0275EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0275EBFE,7FFF0001,?,0275DB55,7FFF0001), ref: 0275EBD3
RtlAllocateHeap.NTDLL(00000000,?,0275DB55,7FFF0001), ref: 0275EBDA

Part of subcall function 0275EB74: GetProcessHeap.KERNEL32(00000000,00000000,0275EC28,00000000,?,0275DB55,7FFF0001), ref: 0275EB81
Part of subcall function 0275EB74: HeapSize.KERNEL32(00000000,?,0275DB55,7FFF0001), ref: 0275EB88

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: d6f49c8b696f9558869bade65015575710b1b3dbcad5d9d12ec0ba6c94faf121
Instruction ID: 69bd62ac0ed8a805850a38be2625403b9a56bb31507590edd64cabea1a74db88
Opcode Fuzzy Hash: d6f49c8b696f9558869bade65015575710b1b3dbcad5d9d12ec0ba6c94faf121
Instruction Fuzzy Hash: 3DC08C32A483306BCA0627A8BC0CF9E7E98FF083A3F048814FA09C2150CB3049508BA2

Function 0275F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,0275CA44), ref: 0275F476

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 997efeca99d976ecddd7f7fd2aef3a73e9b96c0e5a702cec6920ab2615b3ee4a
Instruction ID: e10abca4124db580e46b22a38ef35f225411ea42155c2b19da1716e200ae145c
Opcode Fuzzy Hash: 997efeca99d976ecddd7f7fd2aef3a73e9b96c0e5a702cec6920ab2615b3ee4a
Instruction Fuzzy Hash: 5FF01C7220156AAB9B119E9ADC84CAB7BAEFB8A2507040522FE14D7110D671E8218BA1

Function 02751978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02751992

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: c61b578634f1904c231045d56adfa89ba7631fd5e92420e409cf1fb4ad483455
Instruction ID: 0097ce0e9cdbe244cbb6d27b2d9e18bdaaa8a69d7a4ee2141f828e2758815081
Opcode Fuzzy Hash: c61b578634f1904c231045d56adfa89ba7631fd5e92420e409cf1fb4ad483455
Instruction Fuzzy Hash: 2AD012265486316A52112759BC085BFEB9CEF45662B51981AFC48C0150D735C8418796

Function 0275DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 0275DDB5

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 28f78530d7cba8394a925e359d7dde91ce49ac608153d0908256dfebe095bfc4
Instruction ID: 5390a650e743f33046b1deee8cc0d38eb834991802f538ec371effdae6546f04
Opcode Fuzzy Hash: 28f78530d7cba8394a925e359d7dde91ce49ac608153d0908256dfebe095bfc4
Instruction Fuzzy Hash: F1F08C32200322EBCB30CE269888656F3E8EB8622AF14483FE955D2150DBB1D855CBA1

Non-executed Functions

Function 0275637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02759816,EntryPoint), ref: 0275638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02759816,EntryPoint), ref: 027563A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 027563CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 027563EB

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 9fba57783d8fe5b30e421e0cc0fd7b69765b5f6a1e413b44c488f9b7ace3343f
Instruction ID: 956574d21ff99e80321189f9e62f9c829afa5ac2dc8f05513646b1ba84a4475e
Opcode Fuzzy Hash: 9fba57783d8fe5b30e421e0cc0fd7b69765b5f6a1e413b44c488f9b7ace3343f
Instruction Fuzzy Hash: 4711A771A00229BFEB115F65DC49F9B7BACEB047A4F004464FD04E7240D7B0DD108AA0

Function 02751000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02751839,02759646), ref: 02751012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 027510C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 027510E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02751101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02751121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02751140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02751160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02751180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0275119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 027511BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 027511DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 027511FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0275121A

Strings

NtQueryInformationToken, xrefs: 02751262
NtSetInformationThread, xrefs: 02751155
NtClose, xrefs: 027511B4
ntdll.dll, xrefs: 0275100D
RtlInitUnicodeString, xrefs: 02751135
RtlNtStatusToDosError, xrefs: 02751194
NtDuplicateToken, xrefs: 027511F3
RtlLengthSid, xrefs: 02751246
RtlSetLastWin32Error, xrefs: 027510D6
RtlExpandEnvironmentStrings_U, xrefs: 027510BC
NtFilterToken, xrefs: 0275122B
NtTerminateProcess, xrefs: 027510F6
RtlAllocateAndInitializeSid, xrefs: 0275120F
RtlFreeSid, xrefs: 02751116
NtSetInformationToken, xrefs: 02751175
NtOpenProcessToken, xrefs: 027511D4

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 0142e04d51ddd8c5b480bffa458f3e214b6f88c0d20959e57c63562b8d736744
Instruction ID: a73ec60e945dc2703742f702f47252bdc4fb46e2dce39249dfe516f18b67892e
Opcode Fuzzy Hash: 0142e04d51ddd8c5b480bffa458f3e214b6f88c0d20959e57c63562b8d736744
Instruction Fuzzy Hash: 4D51E3B1E82711AAE719CA6CEC8C76277E86748B2DF448796DC29D22D0D7F0C491CF51

Function 0275B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0275B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0275B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0275B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0275B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0275B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0275B329
wsprintfA.USER32 ref: 0275B3B7

Strings

Thu, xrefs: 0275B241
May, xrefs: 0275B272
Sep, xrefs: 0275B28E
Wed, xrefs: 0275B23A
Sat, xrefs: 0275B24F
Sun, xrefs: 0275B225
Fri, xrefs: 0275B248
Apr, xrefs: 0275B26B
Jan, xrefs: 0275B256
Tue, xrefs: 0275B233
Jun, xrefs: 0275B279
Jul, xrefs: 0275B280
Dec, xrefs: 0275B2A3
Mon, xrefs: 0275B22C
Aug, xrefs: 0275B287
Nov, xrefs: 0275B29C
Feb, xrefs: 0275B25D
Oct, xrefs: 0275B295
Mar, xrefs: 0275B264
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0275B3AF

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 66e007f8e325ae4c886153420db67dc4af7adcb974e789f2eb97ffc20687b260
Instruction ID: 2184a987d8a3451ab5ed45733bd83b77b5de96fd736dee8e668cb0a7d885ed90
Opcode Fuzzy Hash: 66e007f8e325ae4c886153420db67dc4af7adcb974e789f2eb97ffc20687b260
Instruction Fuzzy Hash: A1510AB1E0122CAACF15DFD5D9899FFBBBAFF48308F114469EA01B6150D3744A99CB90

Function 02756511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0275654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0275655C
htonl.WS2_32(?), ref: 02756578
htonl.WS2_32(?), ref: 02756587
wsprintfA.USER32 ref: 0275659B
wsprintfA.USER32 ref: 027565DC
wsprintfA.USER32 ref: 02756671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0275668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02756696
wsprintfA.USER32 ref: 027566B0
wsprintfA.USER32 ref: 027566E7
wsprintfA.USER32 ref: 027566FF
wsprintfA.USER32 ref: 0275671F
ExitProcess.KERNEL32 ref: 02756755

Strings

Jan 13 2018, xrefs: 0275653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0275666B
plgs:, xrefs: 027566AA
localcfg, xrefs: 0275672D
12:08:32, xrefs: 02756535
except_info, xrefs: 02756728
%d=%p, xrefs: 027566F9
va=%08X%08X uef=%p, xrefs: 02756595
ver=%d date=%s %sc=%08x a=%p, xrefs: 02756547
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 027565D6

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 62e35cc7a02399b527f7a9f90aa16998b0b8539852f34a4d89edd2bfe14d5b10
Instruction ID: 68e9ddfccabf889454e6663a6ed3433042ec5718eb9f5d4b35c4664d0412f9f6
Opcode Fuzzy Hash: 62e35cc7a02399b527f7a9f90aa16998b0b8539852f34a4d89edd2bfe14d5b10
Instruction Fuzzy Hash: 74615DB2950218AFEB609FB4DC49FEA7BE9FF08300F148469FD69D2121DB7199548F50

Function 0275A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0275A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0275A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0275A893
wsprintfA.USER32 ref: 0275A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0275A8D2
wsprintfA.USER32 ref: 0275A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0275A97C
wsprintfA.USER32 ref: 0275A9B9

Strings

Error sending command (sent = %d/%d), xrefs: 0275A8A7, 0275A8DA
data, xrefs: 0275A85E
., xrefs: 0275A8CA
ehlo %s, xrefs: 0275A7F5
AUTH LOGIN, xrefs: 0275A80C
localcfg, xrefs: 0275AB0B
quit, xrefs: 0275A86C
ESMTP, xrefs: 0275AA38
helo %s, xrefs: 0275A803
Too small respons, xrefs: 0275A9C9
Too big smtp respons (%d bytes), xrefs: 0275A9B1
mail from:<%s>, xrefs: 0275A848
rcpt to:<%s>, xrefs: 0275A855
Incorrect respons, xrefs: 0275AB39

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 4e1f24ef603b6f7fb0bcd3a93c6b676ecc065728c2dc801e0f1749fd1a95169e
Instruction ID: b98817dab7a3a7a3dd1c67403ed0c525cb2fa719c7a6f73343d7bd2ffbd172ee
Opcode Fuzzy Hash: 4e1f24ef603b6f7fb0bcd3a93c6b676ecc065728c2dc801e0f1749fd1a95169e
Instruction Fuzzy Hash: 67A13B71D44339ABEF118A54DC89FBEFB66BB00308F144676FD06A6080EBF19944CB95

Function 02751280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0275139A
lstrlenW.KERNEL32(-00000003), ref: 02751571

Strings

, xrefs: 02751462
PDGu, xrefs: 0275139A
uac, xrefs: 02751628
@, xrefs: 02751380
%systemroot%\system32\cmd.exe, xrefs: 02751316
wusa.exe, xrefs: 02751388
D, xrefs: 027515C6
useless, xrefs: 0275161E
<, xrefs: 02751378

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 7331bd842e54e1d6745a870078ef2019dc924ab0dc7ced3e8dfd2c36b3aa4be7
Instruction ID: aae6086ed1f493ba862702530bc126998f212a39e5196c795f8938b48ebcd761
Opcode Fuzzy Hash: 7331bd842e54e1d6745a870078ef2019dc924ab0dc7ced3e8dfd2c36b3aa4be7
Instruction Fuzzy Hash: A2F17AB59083519FE320DF64C888B6AF7E5FB88709F408D2DF99A97280D7B49944CF52

Function 02752A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 02752A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 02752A86
socket.WS2_32(00000002,00000002,00000011), ref: 02752AA0
htons.WS2_32(00000000), ref: 02752ADB
select.WS2_32 ref: 02752B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02752B4A
htons.WS2_32(?), ref: 02752B71
htons.WS2_32(?), ref: 02752B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02752BFB

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 6f8f92d98bb280e23f7ba8b0ceaedf795d6eedf8db7bd40fdd0ad351e2648893
Instruction ID: 817795f054e7472a95a141c7f5ebe70bdc9cdb4307f65aa530ad22406546e7d9
Opcode Fuzzy Hash: 6f8f92d98bb280e23f7ba8b0ceaedf795d6eedf8db7bd40fdd0ad351e2648893
Instruction Fuzzy Hash: E661BD719053259FD720AF64DC48B6BFBE8FB88745F054809FD49A7242D7F0E8448BA2

Function 0275704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 027570C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0275719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 027571B2
RegCloseKey.ADVAPI32(75920F10), ref: 02757208
RegCloseKey.ADVAPI32(75920F10), ref: 02757291
___ascii_stricmp.LIBCMT ref: 027572C2
RegCloseKey.ADVAPI32(75920F10), ref: 027572D0
RegCloseKey.ADVAPI32(75920F10), ref: 02757314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0275738D
RegCloseKey.ADVAPI32(75920F10), ref: 027573D8

Part of subcall function 0275F1A5: lstrlenA.KERNEL32(000000C8,000000E4,027622F8,000000C8,02757150,?), ref: 0275F1AD

Strings

, xrefs: 02757194
", xrefs: 02757227

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: f60f7e71c92dc20470e443277ada9b3b715a06e877b1d1cc96e5264c3dcfdb31
Instruction ID: 8e698673d7e2b59c88478a885b953dbee68741b07bc55fd4ee60088d68322ddf
Opcode Fuzzy Hash: f60f7e71c92dc20470e443277ada9b3b715a06e877b1d1cc96e5264c3dcfdb31
Instruction Fuzzy Hash: 1DB16371D44229AFEB199FA4DC48BEFF7B9AF04310F100466FD05E6090EBB59A94CB64

Function 0275AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0275AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0275ADA6

Part of subcall function 0275AD08: gethostname.WS2_32(?,00000080), ref: 0275AD1C
Part of subcall function 0275AD08: lstrlenA.KERNEL32(00000000), ref: 0275AD60
Part of subcall function 0275AD08: lstrlenA.KERNEL32(00000000), ref: 0275AD69
Part of subcall function 0275AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0275AD7F

Part of subcall function 027530B5: gethostname.WS2_32(?,00000080), ref: 027530D8
Part of subcall function 027530B5: gethostbyname.WS2_32(?), ref: 027530E2

wsprintfA.USER32 ref: 0275AEA5

Part of subcall function 0275A7A3: inet_ntoa.WS2_32(?), ref: 0275A7A9

wsprintfA.USER32 ref: 0275AE4F
wsprintfA.USER32 ref: 0275AE5E

Part of subcall function 0275EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0275EF92
Part of subcall function 0275EF7C: lstrlenA.KERNEL32(?), ref: 0275EF99
Part of subcall function 0275EF7C: lstrlenA.KERNEL32(00000000), ref: 0275EFA0

Strings

----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0275AE49
%OUTLOOK_MID, xrefs: 0275AEAE
%s%d, xrefs: 0275AE58
%OUTLOOK_BND_, xrefs: 0275AE0F, 0275AE14, 0275AE57, 0275AE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0275AE9F
%OUTLOOK_HST, xrefs: 0275AEC5
127.0.0.1, xrefs: 0275ADEB

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 5828fa6be17e15ffc546afa150a67d46d42fa1df103bb7daaad8246ffc47e9f8
Instruction ID: 4cdfea54dfd5aa910d3ddce4ec05129f8bade586c6aae5c33323aab3a4ffa7b5
Opcode Fuzzy Hash: 5828fa6be17e15ffc546afa150a67d46d42fa1df103bb7daaad8246ffc47e9f8
Instruction Fuzzy Hash: 744112B290031C6BEB26AFA0DC49EEE7BADFB08304F14482AFD1592151EA71D6548F50

Function 02752DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,02752F0F,?,027520FF,02762000), ref: 02752E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02752F0F,?,027520FF,02762000), ref: 02752E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02752E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02752F0F,?,027520FF,02762000), ref: 02752E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02752F0F,?,027520FF,02762000), ref: 02752E4F
htons.WS2_32(00000035), ref: 02752E88
inet_addr.WS2_32(?), ref: 02752E93
gethostbyname.WS2_32(?), ref: 02752EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02752F0F,?,027520FF,02762000), ref: 02752EE3
HeapFree.KERNEL32(00000000,?,00000000,02752F0F,?,027520FF,02762000), ref: 02752EE6

Strings

iphlpapi.dll, xrefs: 02752DFB, 02752E00, 02752E10
GetNetworkParams, xrefs: 02752E28

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 939c4278115308e4d444a15b86da18ec16d638d6d6bc255dc3bc87b73b2e87c0
Instruction ID: 6cfa33ffa276d1beced68f93aae15881d6d4d38342d4ff4900f47140551e2565
Opcode Fuzzy Hash: 939c4278115308e4d444a15b86da18ec16d638d6d6bc255dc3bc87b73b2e87c0
Instruction Fuzzy Hash: E431A231E4031AABDB119BB89C4CB6FBBB8BF04365F144519ED14E7281DBB0D9528B50

Function 02759326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02759DD7,?,00000022,?,?,00000000,00000001), ref: 02759340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02759DD7,?,00000022,?,?,00000000,00000001), ref: 0275936E
GetModuleFileNameA.KERNEL32(00000000,?,02759DD7,?,00000022,?,?,00000000,00000001), ref: 02759375
wsprintfA.USER32 ref: 027593CE
wsprintfA.USER32 ref: 0275940C
wsprintfA.USER32 ref: 0275948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 027594F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02759526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02759571

Strings

runas, xrefs: 02759674

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b878a65bebbb63f9754cda2ab3cea01967004b78ffe2333b7e603161dc287881
Instruction ID: 6cd7f671a59c483481b0a0e0833654304767344e52a15303cdd4f638bb93cfde
Opcode Fuzzy Hash: b878a65bebbb63f9754cda2ab3cea01967004b78ffe2333b7e603161dc287881
Instruction Fuzzy Hash: EFA16DB1940268EFEB269FA0CC49FDE7BADFB04740F104466FE0592142E7B59554CFA1

Function 0275B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0275B467

Part of subcall function 0275EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0275EF92
Part of subcall function 0275EF7C: lstrlenA.KERNEL32(?), ref: 0275EF99
Part of subcall function 0275EF7C: lstrlenA.KERNEL32(00000000), ref: 0275EFA0

Strings

%TO_HASH, xrefs: 0275B4B0
%FROM_DOMAIN, xrefs: 0275B41E
%TO_EMAIL, xrefs: 0275B473
%FROM_EMAIL, xrefs: 0275B3E9
%s@%s, xrefs: 0275B461
%P5DATE, xrefs: 0275B4F2
%FROM_USER, xrefs: 0275B431
%TO_DOMAIN, xrefs: 0275B44B
%M5DATE, xrefs: 0275B50F
%TO_USER, xrefs: 0275B488
%DATE, xrefs: 0275B4D2

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 45163d1d8636d371451845d895c6701ff2caf840d92d91002d4c543d2543875b
Instruction ID: 1fc45ab62c381a5f16ff980020c4011c71e76e3dde6911f48c3fc6c2c24fd416
Opcode Fuzzy Hash: 45163d1d8636d371451845d895c6701ff2caf840d92d91002d4c543d2543875b
Instruction Fuzzy Hash: 3A4120B25411297FEB02AB94CCC9DFFBF6EFF49648F140425FD05A2040DBB1AA149BA1

Function 02752011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02752078
GetTickCount.KERNEL32 ref: 027520D4
GetTickCount.KERNEL32 ref: 027520DB
GetTickCount.KERNEL32 ref: 0275212B
GetTickCount.KERNEL32 ref: 02752132
GetTickCount.KERNEL32 ref: 02752142

Part of subcall function 0275F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0275E342,00000000,7508EA50,80000001,00000000,0275E513,?,00000000,00000000,?,000000E4), ref: 0275F089
Part of subcall function 0275F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0275E342,00000000,7508EA50,80000001,00000000,0275E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0275F093

Part of subcall function 0275E854: lstrcpyA.KERNEL32(00000001,?,?,0275D8DF,00000001,localcfg,except_info,00100000,02760264), ref: 0275E88B
Part of subcall function 0275E854: lstrlenA.KERNEL32(00000001,?,0275D8DF,00000001,localcfg,except_info,00100000,02760264), ref: 0275E899

Part of subcall function 02751C5F: wsprintfA.USER32 ref: 02751CE1

Strings

localcfg, xrefs: 02752070, 02752160, 02752186, 02752194, 027521E4
rbl_ip, xrefs: 0275218F
rbl_bl, xrefs: 02752181
net_type, xrefs: 027521DF

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: b340cd51659058c8897d1ff87f284920f758b7d9441901762afd204cde6b91c8
Instruction ID: 25fddffa2ffc2bdfaffbce4ef05771fc77f9ef1ec40265c6a07c779f1d1339e1
Opcode Fuzzy Hash: b340cd51659058c8897d1ff87f284920f758b7d9441901762afd204cde6b91c8
Instruction Fuzzy Hash: 48514370E893569EE369EF30ED4DB27BBD5AF00304F09481EEE4986193DBF4A454CA11

Function 0275C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0275A4C7: GetTickCount.KERNEL32 ref: 0275A4D1
Part of subcall function 0275A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0275A4FA

GetTickCount.KERNEL32 ref: 0275C31F
GetTickCount.KERNEL32 ref: 0275C32B
GetTickCount.KERNEL32 ref: 0275C363
GetTickCount.KERNEL32 ref: 0275C378
GetTickCount.KERNEL32 ref: 0275C44D
InterlockedIncrement.KERNEL32(0275C4E4), ref: 0275C4AE
CreateThread.KERNEL32(00000000,00000000,0275B535,00000000,?,0275C4E0), ref: 0275C4C1
CloseHandle.KERNEL32(00000000,?,0275C4E0,02763588,02758810), ref: 0275C4CC

Strings

localcfg, xrefs: 0275C2DD

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 3b8894d0ae5d62690ede96e6539d18b8f7a243e4142423bc1bf9cdc11a3a615f
Instruction ID: dd989b0e2eda385abfdc361fecf531a8c98d5969d87ebd38a9e2984f69d971af
Opcode Fuzzy Hash: 3b8894d0ae5d62690ede96e6539d18b8f7a243e4142423bc1bf9cdc11a3a615f
Instruction Fuzzy Hash: 69518AB1A00B558FD7658F69C684A2AFBE9FB48304B505D3ED98BC7A90D7B4F844CB10

Function 0275BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0275BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0275BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0275BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0275BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0275BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0275BF94

Strings

smtp_ban, xrefs: 0275BE55, 0275BF77
smtp_retr, xrefs: 0275BE61, 0275BF8C
smtp_herr, xrefs: 0275BE46, 0275BF62

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: b20ce44ec0c17694b24ff53c934a507606c3d1b50d6e1918165ff74a5c607424
Instruction ID: 3962d22777067f9e13100575928072720cca5928f3905f51066d5ec1c0e42b04
Opcode Fuzzy Hash: b20ce44ec0c17694b24ff53c934a507606c3d1b50d6e1918165ff74a5c607424
Instruction Fuzzy Hash: A851D471A0032AEFEB118F65C884B7EFBA9AF0534CF046455EC41AB258D7B0E951CF90

Function 02756A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,02759A60,?,?,02759E9D), ref: 02756A7D
GetDiskFreeSpaceA.KERNEL32(02759E9D,02759A60,?,?,?,027622F8,?,?,?,02759A60,?,?,02759E9D), ref: 02756ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02759A60,?,?,02759E9D), ref: 02756B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02759A60,?,?,02759E9D), ref: 02756B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02759A60,?,?,02759E9D), ref: 02756B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02759A60,?,?,02759E9D), ref: 02756B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02759A60,?,?,02759E9D), ref: 02756B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02759A60,?,?,02759E9D), ref: 02756B80
GetLastError.KERNEL32(?,?,?,02759A60,?,?,02759E9D,?,?,?,?,?,02759E9D,?,00000022,?), ref: 02756B96

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: d5bd9ce14a2266b5d0ee312315164939449698b722be849e129654ecc4aedcda
Instruction ID: 084e7583e5872de33e511c1c40cf6eac7d1b9100c400822f72ed8e8d91ab00bd
Opcode Fuzzy Hash: d5bd9ce14a2266b5d0ee312315164939449698b722be849e129654ecc4aedcda
Instruction Fuzzy Hash: CB31D3B2D0065DBFDB019FA48848ADEBB7DFB44310F148866EA51A3241D77099558F61

Function 02756F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0275D7C3), ref: 02756F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0275D7C3), ref: 02756FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02756FE8
LocalFree.KERNEL32(00000120), ref: 0275701F
wsprintfA.USER32 ref: 02757036

Strings

|, xrefs: 02756FB3
/%d, xrefs: 02757030

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 862da33209c1d56c0b7b2df4d978241268d9e32ae334be2a81725d46896526c9
Instruction ID: 69678d3c7f35658fb3d25424002109c6c011cd1254aec6604a3d2f406a46c018
Opcode Fuzzy Hash: 862da33209c1d56c0b7b2df4d978241268d9e32ae334be2a81725d46896526c9
Instruction Fuzzy Hash: 99311872900219AFDB01DFA8D849AEABBBDFF05314F048166F859DB140EB75D6088B94

Function 02756CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,027622F8,000000E4,02756DDC,000000C8), ref: 02756CE7
GetProcAddress.KERNEL32(00000000), ref: 02756CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02756D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02756D2B

Strings

kernel32, xrefs: 02756CE2
GetSystemWow64DirectoryA, xrefs: 02756CDD
C:\Windows\SysWOW64\, xrefs: 02756CC9, 02756CD1, 02756CFE, 02756D05, 02756D13, 02756D1E, 02756D2A, 02756D42, 02756D5F, 02756D85

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 9542d6e5f0624c28044dd2837f5d943ba82aa00b8413b11afb8c7e20b2951470
Instruction ID: 3337ccf24a9ea51e673df8215b898ffa50954ea1355186217375681c7e3025cf
Opcode Fuzzy Hash: 9542d6e5f0624c28044dd2837f5d943ba82aa00b8413b11afb8c7e20b2951470
Instruction Fuzzy Hash: 28215B61E813707AFB7256334C8CF7BBE4D9B02744F0C8854FC04A6082DBE58555C6B5

Function 0275977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02759947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,027622F8), ref: 027597B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,027622F8), ref: 027597EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,027622F8), ref: 027597F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,027622F8), ref: 02759831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,027622F8), ref: 0275984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,027622F8), ref: 0275985B

Strings

D, xrefs: 027597A9

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 271371436ddafb281aa5765075b937b75b3bd5adb83c63167eef9a1181d95946
Instruction ID: 8a47c40a668ec309b5fd8acb33905b3726183cac7b1b02267b1190aa78f71f08
Opcode Fuzzy Hash: 271371436ddafb281aa5765075b937b75b3bd5adb83c63167eef9a1181d95946
Instruction Fuzzy Hash: 89212AB1D41229EBDB119FA1DC49FEFBBBCEF09654F004861FA19E1040EBB09654CAA0

Function 0275E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0275DD05: GetTickCount.KERNEL32 ref: 0275DD0F
Part of subcall function 0275DD05: InterlockedExchange.KERNEL32(027636B4,00000001), ref: 0275DD44
Part of subcall function 0275DD05: GetCurrentThreadId.KERNEL32 ref: 0275DD53

Part of subcall function 0275DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0275DDB5

lstrcpynA.KERNEL32(?,02751E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0275EAAA,?,?), ref: 0275E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0275EAAA,?,?,00000001,?,02751E84,?), ref: 0275E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0275EAAA,?,?,00000001,?,02751E84,?,0000000A), ref: 0275E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0275EAAA,?,?,00000001,?,02751E84,?), ref: 0275E94F

Strings

localcfg, xrefs: 0275E8AB
flags_upd, xrefs: 0275E8A7

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: dc75d56b8400006e865ec848e6743fbd9fa1a4242cfa27006eaa601ea83dc982
Instruction ID: ea7642e8123443c543650808fd13aaacd5fbd5bd946fcd3958400a2ed93d4bcf
Opcode Fuzzy Hash: dc75d56b8400006e865ec848e6743fbd9fa1a4242cfa27006eaa601ea83dc982
Instruction Fuzzy Hash: 66510E72D0021AAFDB11EFA8C984DAEF7F9BF48304F14456AE805A7210D775EA15CF54

Function 02756BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02756BB2

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 678672a19a914ec62b024be9784d4981ad5b6fa39ff3e4f801c542d66a349832
Instruction ID: 1dffaa3ab2dd4d5c26342ab53865875fcc86a3400ce035aab86b111d7bbfe54b
Opcode Fuzzy Hash: 678672a19a914ec62b024be9784d4981ad5b6fa39ff3e4f801c542d66a349832
Instruction Fuzzy Hash: 7A21B772905225FFDB115B70ED8CD9FBBADEB05764B108915FD02E1080EBB1EA10DA74

Function 02759064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,027622F8), ref: 0275907B
wsprintfA.USER32 ref: 027590E9
CreateFileA.KERNEL32(027622F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0275910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02759122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0275912D
CloseHandle.KERNEL32(00000000), ref: 02759134

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: ef7946bf38318fa26e4d81f3d5e09a2a3340d964b3728c4f5c1178cdf9ab21b3
Instruction ID: 20e439364b15b53a7f3bfe9a65387d8207ebe33823bc8a8ad0f66d4c06af63c8
Opcode Fuzzy Hash: ef7946bf38318fa26e4d81f3d5e09a2a3340d964b3728c4f5c1178cdf9ab21b3
Instruction Fuzzy Hash: 63116AB6A401247BF7256672DC0DFAF7A6EDBC5701F00C465FF0AE5051EAB08E118AA0

Function 0275DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0275DD0F
GetCurrentThreadId.KERNEL32 ref: 0275DD20
GetTickCount.KERNEL32 ref: 0275DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0275E538,?,75920F10,?,00000000,?,0275A445), ref: 0275DD3B
InterlockedExchange.KERNEL32(027636B4,00000001), ref: 0275DD44
GetCurrentThreadId.KERNEL32 ref: 0275DD53

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 784625c3eb23531e592a1e586594dae01363215ac6eb418473e42ea5cb393b88
Instruction ID: b79599439d1e232b737039b07da5e739f7dacb06d4d34ed000f5769af1d1a852
Opcode Fuzzy Hash: 784625c3eb23531e592a1e586594dae01363215ac6eb418473e42ea5cb393b88
Instruction Fuzzy Hash: 5EF0E272D84315AFC7905B66B88CB39BBA4F745B12F008856E90BC2241C7B15075CF22

Function 0275AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0275AD1C
lstrlenA.KERNEL32(00000000), ref: 0275AD60
lstrlenA.KERNEL32(00000000), ref: 0275AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0275AD7F

Strings

LocalHost, xrefs: 0275AD79

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: a07e147ce30ca5a8ed348b820e8678c2c19ba90adfee7d8d338f0bd3aca346bf
Instruction ID: a15f5d9b301f413f9bb5dd960a3a4d1a52a0257b5cd25aaa3bb93e43d5613988
Opcode Fuzzy Hash: a07e147ce30ca5a8ed348b820e8678c2c19ba90adfee7d8d338f0bd3aca346bf
Instruction Fuzzy Hash: 5B014920C843A95DDF32263A8848BB5FF666B8764AF0042B6DCC09711DEFE480438761

Function 02754BD1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02754BDD
GetTickCount.KERNEL32 ref: 02754BEC
Sleep.KERNEL32(00000000,?,%FROM_EMAIL,02755D02,00000000,?,0275B85C,?,00000080,?,00000000,00000000,?,%FROM_EMAIL), ref: 02754BF9
InterlockedExchange.KERNEL32(02C1B160,00000001), ref: 02754C02

Strings

%FROM_EMAIL, xrefs: 02754BD1

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID: %FROM_EMAIL
API String ID: 2207858713-2903620461
Opcode ID: 60e6924b817a7dde90deebbc28989eff756e1f79443c8e00f521d48e1a234b26
Instruction ID: d17b4a85106cc6f093818cadd6e59c76da93275ec90426df9c08dd1ed18c205a
Opcode Fuzzy Hash: 60e6924b817a7dde90deebbc28989eff756e1f79443c8e00f521d48e1a234b26
Instruction Fuzzy Hash: 5AE0CD3768532467C7101BB55C88F5AB79CFB85361F064876FF0CD2141C6E694A141B5

Function 02754280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,027598FD,00000001,00000100,027622F8,0275A3C7), ref: 02754290
CloseHandle.KERNEL32(0275A3C7), ref: 027543AB
CloseHandle.KERNEL32(00000001), ref: 027543AE

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 34b6a59a2d7f546455fedfcc9dfe327fcd4e5d8aeccd31f41cfb162c82fb7037
Instruction ID: 265478922fa8f49b17127efb87cf484f97ab4160de599ee2b01df707253541ec
Opcode Fuzzy Hash: 34b6a59a2d7f546455fedfcc9dfe327fcd4e5d8aeccd31f41cfb162c82fb7037
Instruction Fuzzy Hash: 07418DB1C00219BADB11AFA1DD89FAFFFB9EF41364F104555FA15B2190D7B48690CBA0

Function 02756069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,027564CF,00000000), ref: 0275609C
LoadLibraryA.KERNEL32(?,?,027564CF,00000000), ref: 027560C3
GetProcAddress.KERNEL32(?,00000014), ref: 0275614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0275619E

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 7dc764579d866ff2adab1d77f3d70710670455be39a7e4006ed7db8309e39e87
Instruction ID: d0035e76bfee477d08ccfd3a34983f9b9dc9233f95bda4d14358a6a9ca347f05
Opcode Fuzzy Hash: 7dc764579d866ff2adab1d77f3d70710670455be39a7e4006ed7db8309e39e87
Instruction Fuzzy Hash: C1412971E00229ABDB24CF58C884B79F7B9FF04358F548169EC15E7291E7B0E955CB90

Function 02752923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e720bb0e8fc4bbf54d4ce4150d8fc3b63d3a96ea3dc60b67f559c94a398fc8
Instruction ID: e6d33dce5b1601b2e7e40bfdea87359b248e43ca33a4ba29d83146188b98ef6e
Opcode Fuzzy Hash: f6e720bb0e8fc4bbf54d4ce4150d8fc3b63d3a96ea3dc60b67f559c94a398fc8
Instruction Fuzzy Hash: 4B318F71A00328ABDB219FA5CC85BBEB7F4FF48701F108456FD45E6242E3B8E6518B54

Function 027526FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0275272E
htons.WS2_32(00000001), ref: 02752752
htons.WS2_32(0000000F), ref: 027527D5
htons.WS2_32(00000001), ref: 027527E3
sendto.WS2_32(?,02762BF8,00000009,00000000,00000010,00000010), ref: 02752802

Part of subcall function 0275EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0275EBFE,7FFF0001,?,0275DB55,7FFF0001), ref: 0275EBD3
Part of subcall function 0275EBCC: RtlAllocateHeap.NTDLL(00000000,?,0275DB55,7FFF0001), ref: 0275EBDA

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: b7940b74f9fb64d94fefac0f384901303b7fceaa3ed7040db06b64cd81cf8db1
Instruction ID: 8a8fd25fabe18fd9deb3c98b6c281c9b6f9fe248e8a2017cf47e0a690fbbb73e
Opcode Fuzzy Hash: b7940b74f9fb64d94fefac0f384901303b7fceaa3ed7040db06b64cd81cf8db1
Instruction Fuzzy Hash: 59313434A843939FD710CF75D884A62BB60EF19358B1DC86DED598B313E7B29892CB10

Function 02759145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,027622F8), ref: 0275915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02759166
CharToOemA.USER32(?,?), ref: 02759174
wsprintfA.USER32 ref: 027591A9

Part of subcall function 02759064: GetTempPathA.KERNEL32(00000400,?,00000000,027622F8), ref: 0275907B
Part of subcall function 02759064: wsprintfA.USER32 ref: 027590E9
Part of subcall function 02759064: CreateFileA.KERNEL32(027622F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0275910E
Part of subcall function 02759064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02759122
Part of subcall function 02759064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0275912D
Part of subcall function 02759064: CloseHandle.KERNEL32(00000000), ref: 02759134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 027591E1

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 2c0d651ea254e206e2d7f2dad44b7d2585c57f3bfce03e061145b03339575e0c
Instruction ID: 2c213ff7d93af013ef352eb7e9f8af1239a9d232d3d92c37a7eb0bad97860dbd
Opcode Fuzzy Hash: 2c0d651ea254e206e2d7f2dad44b7d2585c57f3bfce03e061145b03339575e0c
Instruction Fuzzy Hash: 330180F6D40268BBEA21A6618C4DFEF7B7CEB85701F000491FB09E2040E6B096848FB0

Function 02752419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02752491,?,?,?,0275E844,-00000030,?,?,?,00000001), ref: 02752429
lstrlenA.KERNEL32(?,?,02752491,?,?,?,0275E844,-00000030,?,?,?,00000001,02751E3D,00000001,localcfg,lid_file_upd), ref: 0275243E
lstrcmpiA.KERNEL32(?,?), ref: 02752452
lstrlenA.KERNEL32(?,?,02752491,?,?,?,0275E844,-00000030,?,?,?,00000001,02751E3D,00000001,localcfg,lid_file_upd), ref: 02752467

Strings

localcfg, xrefs: 0275241F

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 55cb19feba370029a11ff511a936b79bd6c613418d07f3aea35e52c2b3eb807f
Instruction ID: c2c4bde853386cffafd3b39505b825d692128afe4818d780b75f988e6462c309
Opcode Fuzzy Hash: 55cb19feba370029a11ff511a936b79bd6c613418d07f3aea35e52c2b3eb807f
Instruction Fuzzy Hash: 2401DA71600228AFCF11EF69DC849DEBBA9EF44394B05C425ED59A7202E370EE518A94

Function 02751C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02751CE1
wsprintfA.USER32 ref: 02751D6B

Strings

localcfg, xrefs: 02751C70
%u.%u.%u.%u.%s, xrefs: 02751CDB, 02751D65

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 066e1075733a9589a683b973a1efbb6157ad2a2104e8942fdbd42bb7e02fa44d
Instruction ID: f88bb8c77cf5399d3af80ca07ff6846b9b9d7deabc76c508bfba5fba068f9103
Opcode Fuzzy Hash: 066e1075733a9589a683b973a1efbb6157ad2a2104e8942fdbd42bb7e02fa44d
Instruction Fuzzy Hash: EA419C729042A89FDB22CF798C48BEE7BE9AF49311F240056FDA4D3141D775DA05CBA0

Function 0275E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0275DD05: GetTickCount.KERNEL32 ref: 0275DD0F
Part of subcall function 0275DD05: InterlockedExchange.KERNEL32(027636B4,00000001), ref: 0275DD44
Part of subcall function 0275DD05: GetCurrentThreadId.KERNEL32 ref: 0275DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,02755EC1), ref: 0275E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,02755EC1), ref: 0275E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,75920F10,00000000,?,02755EC1), ref: 0275E722

Strings

89ABCDEF, xrefs: 0275E721

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 8e91df8765c712e8dc89e29f59df09704ae51bd6369131bd70584478741dfb5e
Instruction ID: eed0d34ead910a025a84740936c1a172fbcadcbef14693fdf422f011108b9ab6
Opcode Fuzzy Hash: 8e91df8765c712e8dc89e29f59df09704ae51bd6369131bd70584478741dfb5e
Instruction Fuzzy Hash: 4E31E731904726DFDB318F65D888767B7E4FF05394F10882AED9587542E7B0EA80CB81

Function 0275E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0275E2A3,00000000,00000000,00000000,00020106,00000000,0275E2A3,00000000,000000E4), ref: 0275E0B2
RegSetValueExA.ADVAPI32(0275E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,027622F8), ref: 0275E127
RegDeleteValueA.ADVAPI32(0275E2A3,?,?,?,?,?,000000C8,027622F8), ref: 0275E158
RegCloseKey.ADVAPI32(0275E2A3,?,?,?,?,000000C8,027622F8,?,?,?,?,?,?,?,?,0275E2A3), ref: 0275E161

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: a2cae90ea84d8ba863964c58b9ff539d33404a85d0201a04b589452c4fbfcccc
Instruction ID: ea5228114dd5a744923f5a391460b677c4adb0fb0076f37a9a458fb25a4d2691
Opcode Fuzzy Hash: a2cae90ea84d8ba863964c58b9ff539d33404a85d0201a04b589452c4fbfcccc
Instruction Fuzzy Hash: B2215E71E00229BBDF219EA4DC89EDEBF79EF09790F108061FD04A6150E7B18B54CBA0

Function 02753F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0275A3C7,00000000,00000000,000007D0,00000001), ref: 02753F44
GetLastError.KERNEL32 ref: 02753F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02753F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02753F72

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 67ee4e7066351b0e1cf388d34b7fff1b0276bfa8fc1dc043db8e796642178c25
Instruction ID: 92e5ffe5de9da92151997fa23691c703bcdbd1a66a8a95b3d278d31ae6c3520a
Opcode Fuzzy Hash: 67ee4e7066351b0e1cf388d34b7fff1b0276bfa8fc1dc043db8e796642178c25
Instruction Fuzzy Hash: 0F01E972915219ABDF01DE90DD48BEFBB7CFB04395F104455FA01E2090D770DA248BB1

Function 02753F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0275A3C7,00000000,00000000,000007D0,00000001), ref: 02753FB8
GetLastError.KERNEL32 ref: 02753FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02753FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02753FE6

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: e4c77a14aa1c144ff7d9d8be7d4dca71ce38e57f85d2acb0134ba3cbc1c1bfbf
Instruction ID: f35cb489ebf6c497cab09ed34b8025d7c6ead1098f4a3b7a00c3f523b1999136
Opcode Fuzzy Hash: e4c77a14aa1c144ff7d9d8be7d4dca71ce38e57f85d2acb0134ba3cbc1c1bfbf
Instruction Fuzzy Hash: AB01957291021AABDF11DF94D949BAA7B78BB05255F104451ED02E2090D7709A658BB1

Function 0275A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0275A4D1
GetTickCount.KERNEL32 ref: 0275A4E4
Sleep.KERNEL32(00000000,?,0275C2E9,0275C4E0,00000000,localcfg,?,0275C4E0,02763588,02758810), ref: 0275A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0275A4FA

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 87bbd45c894b78aeac49116c2320b917913799a6487267793e24dc151aae4bf2
Instruction ID: 97aeb6012d189af4eaf7854420c85eb8234c4fa0208444e04f7969bd7e4ad47f
Opcode Fuzzy Hash: 87bbd45c894b78aeac49116c2320b917913799a6487267793e24dc151aae4bf2
Instruction Fuzzy Hash: F7E07D3324032567C70017E9AC88F6BB388FB49761F014531FF04E3241D7A6A85181B3

Function 02754E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02754E9E
GetTickCount.KERNEL32 ref: 02754EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02754EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02754EC3

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: aed3014168e266ec7fbbbdaae42bc49020b1d30b22f1d6107d1a09a6b77633f9
Instruction ID: 039ea94281cc9bd38dd10168cbf1c9c02919c03de7480fe16e3892c9e2e21dad
Opcode Fuzzy Hash: aed3014168e266ec7fbbbdaae42bc49020b1d30b22f1d6107d1a09a6b77633f9
Instruction Fuzzy Hash: FEE0CD3374132467D6102BBAAC88F57B749BB45371F010931FF09D2141C6E7D8A245F1

Function 027530FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02753103
GetTickCount.KERNEL32 ref: 0275310F
Sleep.KERNEL32(00000000), ref: 0275311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02753128

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 092cc8bbd227d94a8b6887053dadcc2386a6a726dca070d89a947cbc1043660a
Instruction ID: 0129815a3f1720676b9a58b082479dd37f0cbd1b8e18a970556b6aa2992db37a
Opcode Fuzzy Hash: 092cc8bbd227d94a8b6887053dadcc2386a6a726dca070d89a947cbc1043660a
Instruction Fuzzy Hash: 2EE0C231640325ABDB002B76AD48F49BA5AEF847A1F015871FA01E60A0C6A14C208971

Function 02758CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02758D02
GetTickCount.KERNEL32 ref: 02758DA1

Strings

localcfg, xrefs: 02758D19

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 53af816ba53715bf6c3410fdf7e331874ac2c135374d50b9f3636aafbc4b8cd1
Instruction ID: a59d64ecb3a11b902fc2495bbf0c707559e3ba9aed63f8748e26be6b285cd859
Opcode Fuzzy Hash: 53af816ba53715bf6c3410fdf7e331874ac2c135374d50b9f3636aafbc4b8cd1
Instruction Fuzzy Hash: 7C210A32A10725AFDB10DF76C88866AFBF9FF24714B294599DC01DB201CBB0E980CB51

Function 0275BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0275BFD0
wsprintfA.USER32 ref: 0275C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0275C057

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: f9d551d15d752ffcb2cb5e206e8ab5759700728d1338b8f2158732c38e27c223
Instruction ID: 9ee2676d7985aa0745bd413fe1329ba4dd71885bd2103226ca32f3dd81be278e
Opcode Fuzzy Hash: f9d551d15d752ffcb2cb5e206e8ab5759700728d1338b8f2158732c38e27c223
Instruction Fuzzy Hash: 6A1197B2500100FFDB429AA9CD48E567FA6FF88318B34919CF6188E126D633D863EB50

Function 027538F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 027530FA: GetTickCount.KERNEL32 ref: 02753103
Part of subcall function 027530FA: InterlockedExchange.KERNEL32(?,00000001), ref: 02753128

GetCurrentThreadId.KERNEL32 ref: 02753929
GetCurrentThreadId.KERNEL32 ref: 02753939

Strings

%FROM_EMAIL, xrefs: 02753913

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 311b432f9abce04a9027ba86b78be6e1fbeeba30e1d8273b4a839654cbbdad7f
Instruction ID: 3a76ddd5fa59748a837f450abf6876eb558cc872bd9dd6c8ace6485afd3b163f
Opcode Fuzzy Hash: 311b432f9abce04a9027ba86b78be6e1fbeeba30e1d8273b4a839654cbbdad7f
Instruction Fuzzy Hash: BD118CB1940225EFE721DF19D484A6CF3F5FB0575AF10899EEC4497291C7B0AA80CFA0

Function 0275AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0275BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0275ABB9
InterlockedIncrement.KERNEL32(02763640), ref: 0275ABE1

Strings

%FROM_EMAIL, xrefs: 0275AB8C

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 4c0a7804265a042e44aaf48ebfc1f60e8baa75ef34a7b44e5f470433e24a8553
Instruction ID: 3deece0dc1615d83a81cf624ca2d2852f2196480546b5ebb9854fd888cdfa9cd
Opcode Fuzzy Hash: 4c0a7804265a042e44aaf48ebfc1f60e8baa75ef34a7b44e5f470433e24a8553
Instruction Fuzzy Hash: 17019E71908394AFEB11CF18D885F96BFA6BF15214F144998E9804B203C3B1E544CBD1

Function 027526B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 027526C3
inet_ntoa.WS2_32(?), ref: 027526E4

Strings

localcfg, xrefs: 027526CD, 027526D2, 027526DE

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 50002fc28a3778ceb49ab750151229d018be0010878074914086b03e99fa9dad
Instruction ID: c6c3514abdef8c8641f49c07366e59a781f44779635e058f062bfcfcdd7793c8
Opcode Fuzzy Hash: 50002fc28a3778ceb49ab750151229d018be0010878074914086b03e99fa9dad
Instruction Fuzzy Hash: 0CF082321483287FEB04AEA0EC09AAA779CEF05650F108425FD08DA090EBB1D9508798

Function 0275EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0275EB54,_alldiv,0275F0B7,80000001,00000000,00989680,00000000,?,?,?,0275E342,00000000,7508EA50,80000001,00000000), ref: 0275EAF2
GetProcAddress.KERNEL32(76E80000,00000000), ref: 0275EB07

Strings

ntdll.dll, xrefs: 0275EAED

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: a01cbcb981873a0aaee28f35a67a855c423193cc89fb91235b5f7ac23523aaee
Instruction ID: aba05e7abfb10294f424e4496645e297a49ab3c5c23b8bb573e65876ddc24c3c
Opcode Fuzzy Hash: a01cbcb981873a0aaee28f35a67a855c423193cc89fb91235b5f7ac23523aaee
Instruction Fuzzy Hash: 0AD01274E807029BDF164F65DA0EE19BBE9BB40B02B84C859FC0BD1200E7B0E424DB00

Function 02752F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02752D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,02752F01,?,027520FF,02762000), ref: 02752D3A
Part of subcall function 02752D21: LoadLibraryA.KERNEL32(?), ref: 02752D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02752F73
HeapFree.KERNEL32(00000000), ref: 02752F7A

Memory Dump Source

Source File: 00000013.00000002.3295266720.0000000002750000.00000040.00000400.00020000.00000000.sdmp, Offset: 02750000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2750000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: a56a816796d6baec93392a9425c3e21ca40f17c3a6a3015cf1f58a4aa3a23d90
Instruction ID: 9085c5110f4598b376b2bd6d11081b47e6201a4eb56853558fa555b18fd23d33
Opcode Fuzzy Hash: a56a816796d6baec93392a9425c3e21ca40f17c3a6a3015cf1f58a4aa3a23d90
Instruction Fuzzy Hash: 5851C07190022A9FDF06DF64D888AF9F776FF06304F1045A9EC96D7221E7729A19CB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\szylttbf.exe

C:\Windows\SysWOW64\jcbeaetw\szylttbf.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre