Edit tour

Windows Analysis Report
LisectAVT_2403002A_124.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_124.exe
Analysis ID:	1482514
MD5:	1e6fe7e9dd5292ac6ed4c77d742da69b
SHA1:	5f13634797d7d9c4b670d3e11076680340f89b89
SHA256:	bb1b31f63c63a642be94f71d4dbab8c30c498662ee4269722aca9448eb264d94
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_124.exe (PID: 7292 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_124.exe" MD5: 1E6FE7E9DD5292AC6ED4C77D742DA69B)

LisectAVT_2403002A_124.exe (PID: 7468 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_124.exe" MD5: 1E6FE7E9DD5292AC6ED4C77D742DA69B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.flying-fish-cn.com", "Username": "office@flying-fish-cn.com", "Password": "hkk999@@@                     "}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2914893392.0000000003341000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2914893392.0000000003341000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2914893392.0000000003367000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LisectAVT_2403002A_124.exe PID: 7292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_124.exe PID: 7292	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: LisectAVT_2403002A_124.exe PID: 7292	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LisectAVT_2403002A_124.exe PID: 7468	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_124.exe PID: 7468	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.LisectAVT_2403002A_124.exe.3b857c0.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LisectAVT_2403002A_124.exe.3b857c0.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_124.exe.3b857c0.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3174d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x317bf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31849:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318db:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31945:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x319b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a4d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31add:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3174d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x317bf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31849:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318db:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31945:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x319b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a4d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31add:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.LisectAVT_2403002A_124.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.LisectAVT_2403002A_124.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.LisectAVT_2403002A_124.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3354d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x335bf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33649:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336db:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33745:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x337b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3384d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338dd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3354d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x335bf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33649:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336db:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33745:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x337b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3384d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338dd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3354d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x335bf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dfdf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33649:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e069:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336db:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33745:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e165:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x337b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e1d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3384d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e26d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338dd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e2fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.199.225, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe, Initiated: true, ProcessId: 7468, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49734

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T00:06:03.820057+0200
SID:	2022930
Source Port:	443
Destination Port:	49743
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T00:05:25.683509+0200
SID:	2022930
Source Port:	443
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_124.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://www.google.com

URL Reputation: Label: malware

Found malware configuration

Source: 2.2.LisectAVT_2403002A_124.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.flying-fish-cn.com", "Username": "office@flying-fish-cn.com", "Password": "hkk999@@@ "}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: LisectAVT_2403002A_124.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_124.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: LisectAVT_2403002A_124.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: bdau.pdbSHA256 source: LisectAVT_2403002A_124.exe
Source:	Binary string: bdau.pdb source: LisectAVT_2403002A_124.exe

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Code function: 4x nop then jmp 070A6ED7h

0_2_070A63E6

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 208.91.199.225:587

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 208.91.199.225 208.91.199.225

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 208.91.199.225:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.flying-fish-cn.com

Source: LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.0000000003367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.flying-fish-cn.com
Source: LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.0000000003367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1707385764.0000000002841000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: LisectAVT_2403002A_124.exe	String found in binary or memory: http://www.google.com)Uygun
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_124.exe, 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_124.exe, 00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_124.exe, 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_124.exe, 00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp, LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: LisectAVT_2403002A_124.exe	String found in binary or memory: https://www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, J4qms1IPBw.cs	.Net Code: CcJVCMvNtq
Source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack, J4qms1IPBw.cs	.Net Code: CcJVCMvNtq

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.LisectAVT_2403002A_124.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_026FD5FC	0_2_026FD5FC
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D50040	0_2_04D50040
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D50006	0_2_04D50006
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D574BB	0_2_04D574BB
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_070A1EA0	0_2_070A1EA0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_070A1EB0	0_2_070A1EB0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_070A8DA8	0_2_070A8DA8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_070A4420	0_2_070A4420
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_070A3B48	0_2_070A3B48
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_070A1A6A	0_2_070A1A6A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_070A22E8	0_2_070A22E8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_0190A198	2_2_0190A198
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_0190E2D0	2_2_0190E2D0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_0190A968	2_2_0190A968
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_01904A98	2_2_01904A98
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_01903E80	2_2_01903E80
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_019041C8	2_2_019041C8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F66690	2_2_06F66690
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F65680	2_2_06F65680
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F67E18	2_2_06F67E18
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F6B2C0	2_2_06F6B2C0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F6C208	2_2_06F6C208
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F63138	2_2_06F63138
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F6E6D8	2_2_06F6E6D8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F67738	2_2_06F67738
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F65D98	2_2_06F65D98
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F60040	2_2_06F60040
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_06F60007	2_2_06F60007

Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1706506438.00000000009FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs LisectAVT_2403002A_124.exe
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1707385764.00000000028B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebce68969-f7f7-4a25-8c88-95b6e3560c26.exe4 vs LisectAVT_2403002A_124.exe
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1711377513.0000000007880000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs LisectAVT_2403002A_124.exe
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebce68969-f7f7-4a25-8c88-95b6e3560c26.exe4 vs LisectAVT_2403002A_124.exe
Source: LisectAVT_2403002A_124.exe, 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs LisectAVT_2403002A_124.exe
Source: LisectAVT_2403002A_124.exe, 00000002.00000002.2913062877.0000000001338000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs LisectAVT_2403002A_124.exe
Source: LisectAVT_2403002A_124.exe, 00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebce68969-f7f7-4a25-8c88-95b6e3560c26.exe4 vs LisectAVT_2403002A_124.exe
Source: LisectAVT_2403002A_124.exe	Binary or memory string: OriginalFilenamebdau.exeF vs LisectAVT_2403002A_124.exe

Source: LisectAVT_2403002A_124.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.LisectAVT_2403002A_124.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: LisectAVT_2403002A_124.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, Lds5plxAPDj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, LZYJybC.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, wDxPSW1p.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, E0w8WLnyggK.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, ZBSJHga2buE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, M4oIYVa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, kSS2HMsB8.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, kSS2HMsB8.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, srpiv49bMTiOWAWIP3.cs	Security API names: _0020.SetAccessControl
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, srpiv49bMTiOWAWIP3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, srpiv49bMTiOWAWIP3.cs	Security API names: _0020.AddAccessRule
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, srpiv49bMTiOWAWIP3.cs	Security API names: _0020.SetAccessControl
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, srpiv49bMTiOWAWIP3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, srpiv49bMTiOWAWIP3.cs	Security API names: _0020.AddAccessRule
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, XUOos6pd8lC90dYS16.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, XUOos6pd8lC90dYS16.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_124.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Mutant created: \Sessions\1\BaseNamedObjects\iNriaknHNbxGPZAEuTWsxPDLwwW

Source: LisectAVT_2403002A_124.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: LisectAVT_2403002A_124.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe "C:\Users\user\Desktop\LisectAVT_2403002A_124.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe "C:\Users\user\Desktop\LisectAVT_2403002A_124.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe "C:\Users\user\Desktop\LisectAVT_2403002A_124.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: LisectAVT_2403002A_124.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: LisectAVT_2403002A_124.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: LisectAVT_2403002A_124.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: bdau.pdbSHA256 source: LisectAVT_2403002A_124.exe
Source:	Binary string: bdau.pdb source: LisectAVT_2403002A_124.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: LisectAVT_2403002A_124.exe, BowserOdevi.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, srpiv49bMTiOWAWIP3.cs	.Net Code: DL4y3sR9br System.Reflection.Assembly.Load(byte[])
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, srpiv49bMTiOWAWIP3.cs	.Net Code: DL4y3sR9br System.Reflection.Assembly.Load(byte[])
Source: 0.2.LisectAVT_2403002A_124.exe.5010000.6.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])

Source: LisectAVT_2403002A_124.exe

Static PE information: 0xE56C8780 [Fri Dec 21 17:04:00 2091 UTC]

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_026FC9B7 push cs; iretd	0_2_026FC9C6
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_026FF2A8 push ebx; iretd	0_2_026FF2C2
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_026FF343 push edi; iretd	0_2_026FF34A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_026FF33B push esp; iretd	0_2_026FF35A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_026FF330 push esi; iretd	0_2_026FF33A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_026F99B0 push ss; iretd	0_2_026F99BE
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_026FFE00 push edx; iretd	0_2_026FFE06
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_026FFEA8 push ebx; iretd	0_2_026FFEAE
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D5E300 push esp; ret	0_2_04D5E301
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D50D45 push cs; iretd	0_2_04D50D5E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D50F10 push esp; iretd	0_2_04D50F1E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D51453 push esp; iretd	0_2_04D5145E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D51090 push esi; iretd	0_2_04D5139E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D51036 push esp; iretd	0_2_04D51046
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D59C90 pushad ; iretd	0_2_04D59C9E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D5FDE8 pushad ; iretd	0_2_04D5FDF6
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D51D2A push ebp; iretd	0_2_04D51D2C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D51EA1 push ebp; iretd	0_2_04D51EA3
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_04D51A98 push esp; iretd	0_2_04D51AA6
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_070A750F push esp; iretd	0_2_070A751E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 0_2_070A7478 push esp; iretd	0_2_070A7486
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Code function: 2_2_01900C6D push edi; retf	2_2_01900C7A

Source: LisectAVT_2403002A_124.exe

Static PE information: section name: .text entropy: 7.896114394358964

Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, ruBmFpm4X0qjugVge7.cs	High entropy of concatenated method names: 'S4hYDT4hVy', 'jAUYI7axYT', 'WZJY3Elr6k', 'D9vY5ClB2P', 'JPAYKEccgk', 'dfQYbwDAe4', 'bvtYU9uIZF', 't4XYeJXCPk', 'blRpIpNBtSFVJVgOtym', 'zn89spNTw3lQBjZuXW0'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, pbkn9fEkmSVUYuCkvS.cs	High entropy of concatenated method names: 'lHAdaoBRre', 'JaidMqqhXx', 'Y1Hdx2BHyj', 'cgMdml8sG5', 'evidHNviOb', 'rENdJuVf2K', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, bCFVduyjvCLQ4fLpy0.cs	High entropy of concatenated method names: 'wVEViUOos6', 'r8lV9C90dY', 'Cu6VcWblV1', 'xIrVRMiUm5', 'BgrV0ZU9Zh', 'KiiVFVexeN', 'bwhNZhreVx9QTSVG0w', 'jdLKgLcQa0AmHv311O', 'uvrVVft53X', 'XmXV6aaUBF'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, utNK7KUu6WblV1IIrM.cs	High entropy of concatenated method names: 'u57w513MuX', 've8wKvxG4J', 'BUswpC97rF', 'AH1wUhhCGV', 'l4Kw0MuSQo', 'BGXwFTAob0', 'pRKwtxxR0x', 'FA1wdWAmln', 'uVUwnYF3GV', 'Qk3wPHjDp4'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, PCflYOVCbwNgY8uR9ZV.cs	High entropy of concatenated method names: 'Eq2PI2KXmg', 'ksQPAKLZVi', 'mARP36VN2A', 'hCcOsY6jUSI9Nca7Q7u', 'G2QdN56zs4G0utlihuh', 'rHDVFVo2eP8gP5SJLbU', 'nxb3SZoYIeG1bDEO3ns'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, jUm5kmeyT99nKKgrZU.cs	High entropy of concatenated method names: 'eoUogLSHGI', 'uimobCU8VR', 'agZwxtZ9OU', 'ElswmJNOtg', 'B5qwJY8Wud', 'k18wZApgRe', 'WqYwToDcdY', 'vZbwG7Ugkt', 'n4ZwhUiEdd', 'odiwvoNa0h'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, srpiv49bMTiOWAWIP3.cs	High entropy of concatenated method names: 'LQc6r3Ccfh', 'FT861NkfK7', 'tQj6OcUoEm', 't4J6wGECDN', 'Wbt6oynHcT', 'CUg6Yt0Ve2', 'Txq6iqA8ca', 'Mk169Ivt6i', 'RRR68FfJIH', 'B1m6cwsllV'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, FKwAAtV6FrV5jsHTDqJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Ry6PHS53I9', 'dpTP7YsDgW', 'FVNPl45Yqb', 'TPwPjFULh1', 'Nd0PkFclPS', 'LNmPWqdmOO', 'IMCPBw8vBt'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, sFUK1VC6q0OH8xExVy.cs	High entropy of concatenated method names: 'Vu334ekEs', 'JPq5pkCYl', 'WUDKRxgn6', 'ckrbxrSGa', 'IchU9ofiK', 'X43epn0Me', 'c8wa7WVXO5p3CEhh0w', 'vsNR35OlBJNIyrESnk', 'cqTdg8wto', 'PcNPN6oVE'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, kZhTiiaVexeNqOxELb.cs	High entropy of concatenated method names: 'UJiYrEPrQg', 'i6hYOVE34B', 'cJsYoqIbgU', 'uk1Yifve6j', 'mV1Y9fXm8M', 'VwcokXrvsr', 'hnSoWeDnv0', 'VItoBA5kHC', 'wAAouxNIAE', 'yM5oEtCRiv'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, MGTbHnl7vRYKMihGcc.cs	High entropy of concatenated method names: 'ToString', 'IgXF4346SE', 'isDFMUf9AG', 'T0HFxR3jWV', 'DjhFmL2WFf', 'j9JFJXMBtu', 'KLiFZurmi8', 'M1cFTg7qNM', 'U3DFGY1yGm', 'dkAFhJtNxh'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, INEnmnwF2qjVFH3cOR.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'glQCENeRIn', 'JYnCsOGBMY', 'AddCzwWwEr', 'Jbm6QsnyU7', 'CId6Vn8Pxv', 'upF6CQCx0S', 'yZm665kBk2', 'LgIL0TY7J5e1o8b17jT'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, mKDuTFVQE6QgBE6HCcr.cs	High entropy of concatenated method names: 'vdRnIakyo5', 'TwGnALl85N', 'XcXn3IceEe', 'Yfdn5ELvNx', 'KkZngSsdWt', 'Gg6nKXoeI8', 'Wm4nbsn1rN', 'krPnptNVOk', 'joSnUVNB7X', 'JUpnewItqN'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, k57hQczJTqFB4cKpLm.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dWdnfZHMYu', 'Y4mn0l4tKP', 'FJlnFj7Dxn', 'jwPntvYLoC', 'DcNndoSHBq', 'kXrnnNny7M', 'qHQnPf59NG'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, TKpoFdOdwZBGcjEya7.cs	High entropy of concatenated method names: 'Dispose', 'atLVELYDVW', 'ayWCM2W53b', 's2nkkVcXR5', 'EofVsypCIY', 'AZlVzmt0Jr', 'ProcessDialogKey', 'EatCQbkn9f', 'UmSCVVUYuC', 'UvSCC26Awx'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, h8oSwShDsT51Fkc3yZ.cs	High entropy of concatenated method names: 'HSaiISTUjr', 'BKGiAGlGxD', 'VWqi3y98Cf', 'Fd4i5iTLI1', 'YXIiggRcQf', 'uhLiKFCL1r', 'SRHibyoaIj', 'lwpipg8lGw', 'ziYiU2oJZA', 'Fvpie7w4WZ'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, HSCItCjxsCrf5YKUOC.cs	High entropy of concatenated method names: 'rhWtcfRHdr', 'TGytR702cU', 'ToString', 'WH0t1u4ebR', 'ISxtOkH5Aw', 'q6ltwW2hc3', 'AZBtouaDnV', 'xaptYgkqpP', 'o0Rti0eyRB', 'EPTt9XwWOq'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, VVbjCDHVDfIQWckVYA.cs	High entropy of concatenated method names: 'TQV0vXSQnI', 'Cm10SOm0JP', 'XJ50H7Pvb8', 'mG707jxOrt', 'JVy0Mg597M', 'd3X0xFoRKE', 'hLZ0mxEQq2', 'R1E0JZXhDk', 'h2p0Z3GSru', 'qcy0T9H2Yc'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, XUOos6pd8lC90dYS16.cs	High entropy of concatenated method names: 'FrjOHoh6oI', 'LpkO70PuUI', 'rEsOlOTfKJ', 'cJiOj3ujJd', 'rZ2OkKYydR', 'QegOWk5kdB', 'bxoOBqqcvv', 'cTlOufJaqH', 'sE6OE5qpon', 'HbCOsmAMY7'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, hfypCIuY5Zlmt0JrUa.cs	High entropy of concatenated method names: 'k67d1Fm3Id', 'B5ndOCrnSo', 'KpndwmxoOe', 'dhPdo3uY82', 'dRVdYVHO9a', 'iOvdifxfDX', 'VpJd93sMuw', 'ua4d8hxpuC', 'iY0dcOslpR', 'IUhdRo9Ws4'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, icaxvCZ6aqZ3PiHMdJ.cs	High entropy of concatenated method names: 'H6OYlXsbK8', 'IsfYjvRcsM', 'MauYkqxqAg', 'ToString', 'oIMYWCMWjR', 'zOgYBXx1xq', 'Mk5OU7N3A0LruHsmAVI', 'G3Jy3MN0KlSPVL2MDiG', 'BiJGZSNXiGFkErotq7A'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, u6AwxmslUiHFvQuVn9.cs	High entropy of concatenated method names: 'McGnVrXXJT', 'KMKn6MnUaT', 'ms3ny8Giga', 'E0cn1hCbRC', 'amPnOcNo3f', 'KdAnoIAOWU', 'Sx8nYGe1Pe', 'XasdBGJOXS', 'dJtduLDXEy', 'zxXdEvFIm8'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, JRGbcDWbZCZ666nwc5.cs	High entropy of concatenated method names: 'MdItuyMSay', 'T1atsy64Zh', 'O2HdQiT6tI', 'mR6dVbDkxT', 'mSdt4mysjB', 'EFHtSZJ70x', 'UKQtqnn787', 'xvCtHJxETa', 'dnnt7Agea9', 'SmmtlmSuoi'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, KE2aSiTVAwAGmbGpIg.cs	High entropy of concatenated method names: 'rNai1r1vmg', 'cUOiwVfxye', 'ytbiYJR4uB', 'P4EYswsWIy', 'q9ZYzk6uPr', 'Og3iQlyA8s', 'qRFiVXjsRO', 'jYWiCqw3U2', 'Pchi6olICk', 'ne8iylpMdb'
Source: 0.2.LisectAVT_2403002A_124.exe.7880000.8.raw.unpack, Vu60JKqx5NHLYX2BnX.cs	High entropy of concatenated method names: 'eZufpmlTjY', 'PblfU4x0uC', 'Drlfal8UGK', 'wnZfMy8mBe', 'rjXfm9aGps', 'YaLfJoEpbm', 'bblfTAvpSr', 'mVffGBQ8MS', 'j5kfvDhtgS', 'k1kf4POctu'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, ruBmFpm4X0qjugVge7.cs	High entropy of concatenated method names: 'S4hYDT4hVy', 'jAUYI7axYT', 'WZJY3Elr6k', 'D9vY5ClB2P', 'JPAYKEccgk', 'dfQYbwDAe4', 'bvtYU9uIZF', 't4XYeJXCPk', 'blRpIpNBtSFVJVgOtym', 'zn89spNTw3lQBjZuXW0'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, pbkn9fEkmSVUYuCkvS.cs	High entropy of concatenated method names: 'lHAdaoBRre', 'JaidMqqhXx', 'Y1Hdx2BHyj', 'cgMdml8sG5', 'evidHNviOb', 'rENdJuVf2K', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, bCFVduyjvCLQ4fLpy0.cs	High entropy of concatenated method names: 'wVEViUOos6', 'r8lV9C90dY', 'Cu6VcWblV1', 'xIrVRMiUm5', 'BgrV0ZU9Zh', 'KiiVFVexeN', 'bwhNZhreVx9QTSVG0w', 'jdLKgLcQa0AmHv311O', 'uvrVVft53X', 'XmXV6aaUBF'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, utNK7KUu6WblV1IIrM.cs	High entropy of concatenated method names: 'u57w513MuX', 've8wKvxG4J', 'BUswpC97rF', 'AH1wUhhCGV', 'l4Kw0MuSQo', 'BGXwFTAob0', 'pRKwtxxR0x', 'FA1wdWAmln', 'uVUwnYF3GV', 'Qk3wPHjDp4'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, PCflYOVCbwNgY8uR9ZV.cs	High entropy of concatenated method names: 'Eq2PI2KXmg', 'ksQPAKLZVi', 'mARP36VN2A', 'hCcOsY6jUSI9Nca7Q7u', 'G2QdN56zs4G0utlihuh', 'rHDVFVo2eP8gP5SJLbU', 'nxb3SZoYIeG1bDEO3ns'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, jUm5kmeyT99nKKgrZU.cs	High entropy of concatenated method names: 'eoUogLSHGI', 'uimobCU8VR', 'agZwxtZ9OU', 'ElswmJNOtg', 'B5qwJY8Wud', 'k18wZApgRe', 'WqYwToDcdY', 'vZbwG7Ugkt', 'n4ZwhUiEdd', 'odiwvoNa0h'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, srpiv49bMTiOWAWIP3.cs	High entropy of concatenated method names: 'LQc6r3Ccfh', 'FT861NkfK7', 'tQj6OcUoEm', 't4J6wGECDN', 'Wbt6oynHcT', 'CUg6Yt0Ve2', 'Txq6iqA8ca', 'Mk169Ivt6i', 'RRR68FfJIH', 'B1m6cwsllV'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, FKwAAtV6FrV5jsHTDqJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Ry6PHS53I9', 'dpTP7YsDgW', 'FVNPl45Yqb', 'TPwPjFULh1', 'Nd0PkFclPS', 'LNmPWqdmOO', 'IMCPBw8vBt'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, sFUK1VC6q0OH8xExVy.cs	High entropy of concatenated method names: 'Vu334ekEs', 'JPq5pkCYl', 'WUDKRxgn6', 'ckrbxrSGa', 'IchU9ofiK', 'X43epn0Me', 'c8wa7WVXO5p3CEhh0w', 'vsNR35OlBJNIyrESnk', 'cqTdg8wto', 'PcNPN6oVE'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, kZhTiiaVexeNqOxELb.cs	High entropy of concatenated method names: 'UJiYrEPrQg', 'i6hYOVE34B', 'cJsYoqIbgU', 'uk1Yifve6j', 'mV1Y9fXm8M', 'VwcokXrvsr', 'hnSoWeDnv0', 'VItoBA5kHC', 'wAAouxNIAE', 'yM5oEtCRiv'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, MGTbHnl7vRYKMihGcc.cs	High entropy of concatenated method names: 'ToString', 'IgXF4346SE', 'isDFMUf9AG', 'T0HFxR3jWV', 'DjhFmL2WFf', 'j9JFJXMBtu', 'KLiFZurmi8', 'M1cFTg7qNM', 'U3DFGY1yGm', 'dkAFhJtNxh'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, INEnmnwF2qjVFH3cOR.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'glQCENeRIn', 'JYnCsOGBMY', 'AddCzwWwEr', 'Jbm6QsnyU7', 'CId6Vn8Pxv', 'upF6CQCx0S', 'yZm665kBk2', 'LgIL0TY7J5e1o8b17jT'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, mKDuTFVQE6QgBE6HCcr.cs	High entropy of concatenated method names: 'vdRnIakyo5', 'TwGnALl85N', 'XcXn3IceEe', 'Yfdn5ELvNx', 'KkZngSsdWt', 'Gg6nKXoeI8', 'Wm4nbsn1rN', 'krPnptNVOk', 'joSnUVNB7X', 'JUpnewItqN'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, k57hQczJTqFB4cKpLm.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dWdnfZHMYu', 'Y4mn0l4tKP', 'FJlnFj7Dxn', 'jwPntvYLoC', 'DcNndoSHBq', 'kXrnnNny7M', 'qHQnPf59NG'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, TKpoFdOdwZBGcjEya7.cs	High entropy of concatenated method names: 'Dispose', 'atLVELYDVW', 'ayWCM2W53b', 's2nkkVcXR5', 'EofVsypCIY', 'AZlVzmt0Jr', 'ProcessDialogKey', 'EatCQbkn9f', 'UmSCVVUYuC', 'UvSCC26Awx'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, h8oSwShDsT51Fkc3yZ.cs	High entropy of concatenated method names: 'HSaiISTUjr', 'BKGiAGlGxD', 'VWqi3y98Cf', 'Fd4i5iTLI1', 'YXIiggRcQf', 'uhLiKFCL1r', 'SRHibyoaIj', 'lwpipg8lGw', 'ziYiU2oJZA', 'Fvpie7w4WZ'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, HSCItCjxsCrf5YKUOC.cs	High entropy of concatenated method names: 'rhWtcfRHdr', 'TGytR702cU', 'ToString', 'WH0t1u4ebR', 'ISxtOkH5Aw', 'q6ltwW2hc3', 'AZBtouaDnV', 'xaptYgkqpP', 'o0Rti0eyRB', 'EPTt9XwWOq'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, VVbjCDHVDfIQWckVYA.cs	High entropy of concatenated method names: 'TQV0vXSQnI', 'Cm10SOm0JP', 'XJ50H7Pvb8', 'mG707jxOrt', 'JVy0Mg597M', 'd3X0xFoRKE', 'hLZ0mxEQq2', 'R1E0JZXhDk', 'h2p0Z3GSru', 'qcy0T9H2Yc'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, XUOos6pd8lC90dYS16.cs	High entropy of concatenated method names: 'FrjOHoh6oI', 'LpkO70PuUI', 'rEsOlOTfKJ', 'cJiOj3ujJd', 'rZ2OkKYydR', 'QegOWk5kdB', 'bxoOBqqcvv', 'cTlOufJaqH', 'sE6OE5qpon', 'HbCOsmAMY7'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, hfypCIuY5Zlmt0JrUa.cs	High entropy of concatenated method names: 'k67d1Fm3Id', 'B5ndOCrnSo', 'KpndwmxoOe', 'dhPdo3uY82', 'dRVdYVHO9a', 'iOvdifxfDX', 'VpJd93sMuw', 'ua4d8hxpuC', 'iY0dcOslpR', 'IUhdRo9Ws4'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, icaxvCZ6aqZ3PiHMdJ.cs	High entropy of concatenated method names: 'H6OYlXsbK8', 'IsfYjvRcsM', 'MauYkqxqAg', 'ToString', 'oIMYWCMWjR', 'zOgYBXx1xq', 'Mk5OU7N3A0LruHsmAVI', 'G3Jy3MN0KlSPVL2MDiG', 'BiJGZSNXiGFkErotq7A'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, u6AwxmslUiHFvQuVn9.cs	High entropy of concatenated method names: 'McGnVrXXJT', 'KMKn6MnUaT', 'ms3ny8Giga', 'E0cn1hCbRC', 'amPnOcNo3f', 'KdAnoIAOWU', 'Sx8nYGe1Pe', 'XasdBGJOXS', 'dJtduLDXEy', 'zxXdEvFIm8'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, JRGbcDWbZCZ666nwc5.cs	High entropy of concatenated method names: 'MdItuyMSay', 'T1atsy64Zh', 'O2HdQiT6tI', 'mR6dVbDkxT', 'mSdt4mysjB', 'EFHtSZJ70x', 'UKQtqnn787', 'xvCtHJxETa', 'dnnt7Agea9', 'SmmtlmSuoi'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, KE2aSiTVAwAGmbGpIg.cs	High entropy of concatenated method names: 'rNai1r1vmg', 'cUOiwVfxye', 'ytbiYJR4uB', 'P4EYswsWIy', 'q9ZYzk6uPr', 'Og3iQlyA8s', 'qRFiVXjsRO', 'jYWiCqw3U2', 'Pchi6olICk', 'ne8iylpMdb'
Source: 0.2.LisectAVT_2403002A_124.exe.3c25f30.3.raw.unpack, Vu60JKqx5NHLYX2BnX.cs	High entropy of concatenated method names: 'eZufpmlTjY', 'PblfU4x0uC', 'Drlfal8UGK', 'wnZfMy8mBe', 'rjXfm9aGps', 'YaLfJoEpbm', 'bblfTAvpSr', 'mVffGBQ8MS', 'j5kfvDhtgS', 'k1kf4POctu'
Source: 0.2.LisectAVT_2403002A_124.exe.5010000.6.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.LisectAVT_2403002A_124.exe.5010000.6.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.LisectAVT_2403002A_124.exe.5010000.6.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.LisectAVT_2403002A_124.exe.5010000.6.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.LisectAVT_2403002A_124.exe.5010000.6.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: LisectAVT_2403002A_124.exe PID: 7292, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Memory allocated: 2600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Memory allocated: 2600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Memory allocated: 7900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Memory allocated: 8900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Memory allocated: 8BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Memory allocated: 9BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Memory allocated: 1900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Memory allocated: 32F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Memory allocated: 52F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Window / User API: threadDelayed 1928			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Window / User API: threadDelayed 7875			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7316	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7580	Thread sleep count: 1928 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7580	Thread sleep count: 7875 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -99420s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -99204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -99079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -98954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -98829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -98704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -98579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -98454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -98329s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -98204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -98079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -97954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -97829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -97704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -97579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -97454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -97329s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -97204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -97079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -96954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -96829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -96704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -96579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -96454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -96329s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -96204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -96079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -95954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -95829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -95704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -95579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -95454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -95329s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -95204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -95079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -94954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -94829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -94704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -94579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -94454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -94329s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -94204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -94079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -93954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe TID: 7576	Thread sleep time: -93829s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 99420	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 99204	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 99079	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 98954	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 98829	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 98704	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 98579	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 98454	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 98329	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 98204	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 98079	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 97954	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 97829	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 97704	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 97579	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 97454	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 97329	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 97204	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 97079	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 96954	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 96829	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 96704	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 96579	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 96454	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 96329	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 96204	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 96079	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 95954	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 95829	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 95704	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 95579	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 95454	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 95329	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 95204	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 95079	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 94954	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 94829	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 94704	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 94579	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 94454	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 94329	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 94204	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 94079	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 93954	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Thread delayed: delay time: 93829	Jump to behavior

Source: LisectAVT_2403002A_124.exe, 00000002.00000002.2914025239.000000000177D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Memory written: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Process created: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe "C:\Users\user\Desktop\LisectAVT_2403002A_124.exe"

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.LisectAVT_2403002A_124.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2914893392.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2914893392.0000000003367000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_124.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_124.exe PID: 7468, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_124.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.LisectAVT_2403002A_124.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2914893392.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_124.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_124.exe PID: 7468, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.LisectAVT_2403002A_124.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3bc01e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_124.exe.3b857c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2914893392.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2914893392.0000000003367000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_124.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_124.exe PID: 7468, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_124.exe	100%	Avira	TR/AD.GenSteal.rqtdh
LisectAVT_2403002A_124.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.google.com	100%	URL Reputation	malware
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.google.com	0%	Avira URL Cloud	safe
http://smtp.flying-fish-cn.com	0%	Avira URL Cloud	safe
http://us2.smtp.mailhostbox.com	0%	Avira URL Cloud	safe
http://www.google.com)Uygun	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
us2.smtp.mailhostbox.com	208.91.199.225	true	false	unknown
api.ipify.org	104.26.12.205	true	false	unknown
smtp.flying-fish-cn.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://smtp.flying-fish-cn.com	LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.0000000003367000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	LisectAVT_2403002A_124.exe, 00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_124.exe, 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_124.exe, 00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://us2.smtp.mailhostbox.com	LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.0000000003367000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	LisectAVT_2403002A_124.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	LisectAVT_2403002A_124.exe, 00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_124.exe, 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_124.exe, 00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp, LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.google.com)Uygun	LisectAVT_2403002A_124.exe	true	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.google.com	LisectAVT_2403002A_124.exe, 00000000.00000002.1707385764.0000000002841000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.fonts.com	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	LisectAVT_2403002A_124.exe, 00000002.00000002.2914893392.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	LisectAVT_2403002A_124.exe, 00000000.00000002.1710237885.0000000006912000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
208.91.199.225	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482514
Start date and time:	2024-07-26 00:04:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_124.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 100 Number of non-executed functions: 16
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: LisectAVT_2403002A_124.exe

Simulations

Behavior and APIs

Time	Type	Description
18:05:05	API Interceptor	177x Sleep call for process: LisectAVT_2403002A_124.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	SecuriteInfo.com.Win64.Evo-gen.28044.10443.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	vstdlib_s64.dll.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	6OiUEubyA8.msi	Get hash	malicious	Quasar	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RansomX-gen.22171.1307.exe	Get hash	malicious	Conti, PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	482730621.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	482730621.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/
208.91.199.225	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse
	IEnetcache.hta	Get hash	malicious	Cobalt Strike, AgentTesla, PureLog Stealer	Browse
	winiti.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	0RA0ngi2c2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	z1X3Z1ohoefF078ij.exe	Get hash	malicious	AgentTesla	Browse
	Products and Quote.exe	Get hash	malicious	AgentTesla	Browse
	Purchase Order.exe	Get hash	malicious	AgentTesla	Browse
	ATTACHMENT OF PAYMENT.exe	Get hash	malicious	AgentTesla	Browse
	Luciana Alvarez CV.exe	Get hash	malicious	AgentTesla	Browse
	6bdudXAsQW.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	LisectAVT_2403002A_52.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.14778.18726.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	LCWGT83qLa.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	IEnetcache.hta	Get hash	malicious	Cobalt Strike, AgentTesla, PureLog Stealer	Browse	208.91.199.225
	winiti.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.199.225
	8hOkq9mMQu.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.198.143
	0RA0ngi2c2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.199.225
api.ipify.org	LisectAVT_2403002A_127.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_133.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_2.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_460.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_481.exe	Get hash	malicious	Luna Grabber, Luna Logger	Browse	104.26.12.205
	LisectAVT_2403002A_63.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_59.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_74.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Re_ Q22689 - 07.24.2024_Conduit Construction Network Ltd_Today.eml	Get hash	malicious	Unknown	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	LisectAVT_2403002A_127.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_133.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_147.exe	Get hash	malicious	Blank Grabber	Browse	162.159.138.232
	LisectAVT_2403002A_155.exe	Get hash	malicious	Unknown	Browse	172.67.202.72
	LisectAVT_2403002A_161.exe	Get hash	malicious	Luna Grabber, Luna Logger	Browse	162.159.133.233
	LisectAVT_2403002A_162.exe	Get hash	malicious	Unknown	Browse	104.21.85.44
	https://aecoa.racipens.su/ievqefkwtdjogsyjfdbfnprzYkzLoDtSZBZFTQIDNBMGDEMRMWVOLGXOOCCPHOBAHWORBTIQHFOUAGEIrstXEZnKMUIf12KAT7V5Wwx35	Get hash	malicious	Unknown	Browse	172.67.170.95
	LisectAVT_2403002A_2.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://taf7.rphortan.com/xV5YqZuT/#Xjeffrey.laws@99restaurants.com	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	LisectAVT_2403002A_210.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse	104.16.123.96
PUBLIC-DOMAIN-REGISTRYUS	LisectAVT_2403002A_16.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	LisectAVT_2403002A_52.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	74.119.239.234
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.14778.18726.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	bJrO2iUerN.elf	Get hash	malicious	Unknown	Browse	204.11.58.71
	PO#1164031.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.24
	5RQ24SOW EPIRB_TOTAL Marine Services Ltd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	LisectAVT_2403002A_127.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	LisectAVT_2403002A_133.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	LisectAVT_2403002A_14.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	LisectAVT_2403002A_14.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	LisectAVT_2403002A_155.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	LisectAVT_2403002A_162.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	LisectAVT_2403002A_2.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	LisectAVT_2403002A_220.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	LisectAVT_2403002A_308.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	LisectAVT_2403002A_308.exe	Get hash	malicious	Unknown	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_124.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.8887481114185025
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	LisectAVT_2403002A_124.exe
File size:	705'542 bytes
MD5:	1e6fe7e9dd5292ac6ed4c77d742da69b
SHA1:	5f13634797d7d9c4b670d3e11076680340f89b89
SHA256:	bb1b31f63c63a642be94f71d4dbab8c30c498662ee4269722aca9448eb264d94
SHA512:	1795fbf6bf79ee9799c2b97304fa6d11901c0c7401b2f4dcad343f0f6a0b578e1fd2bf6fdf86c74becc2843d86229b5e80bda64c38b9820fc28232f8da615a24
SSDEEP:	12288:UB+GbFNXl2MIBdcqcUwxW8aNGFDp5T3bzNq8GmNLhnWmIBczDc44CMw:cvRNV2VdcqcUXdaDplzNqIhcczw
TLSH:	CBE402003ABD5B56F8BFCBF8152661415BBA396F2075E32C5CC6B0DE2A7AF004641E67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....l...............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4ad896
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE56C8780 [Fri Dec 21 17:04:00 2091 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor al, 35h
xor eax, 43465138h
push eax
xor eax, 38453452h
xor dl, byte ptr [ecx+eax*2+5Ah]
push esi
dec eax
dec eax
inc ebx
inc esp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xad842	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x5c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xab334	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xab8b4	0xaba00	8167149dc6a340fe1041bb04201ae6fb	False	0.9097607884195194	data	7.896114394358964	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xae000	0x5c4	0x600	307a2a9fec5d43bcd7e455e03742970e	False	0.42578125	data	4.111922568999861	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb0000	0xc	0x200	f5930ee46e35125151ca985a972c87a5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xae090	0x334	data			0.42560975609756097
RT_MANIFEST	0xae3d4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T00:06:03.820057+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49743	40.127.169.103	192.168.2.4
2024-07-26T00:05:25.683509+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49737	40.127.169.103	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 00:05:07.720072031 CEST	49732	443	192.168.2.4	104.26.12.205
Jul 26, 2024 00:05:07.720113039 CEST	443	49732	104.26.12.205	192.168.2.4
Jul 26, 2024 00:05:07.720181942 CEST	49732	443	192.168.2.4	104.26.12.205
Jul 26, 2024 00:05:07.727714062 CEST	49732	443	192.168.2.4	104.26.12.205
Jul 26, 2024 00:05:07.727729082 CEST	443	49732	104.26.12.205	192.168.2.4
Jul 26, 2024 00:05:08.196845055 CEST	443	49732	104.26.12.205	192.168.2.4
Jul 26, 2024 00:05:08.198476076 CEST	49732	443	192.168.2.4	104.26.12.205
Jul 26, 2024 00:05:08.201055050 CEST	49732	443	192.168.2.4	104.26.12.205
Jul 26, 2024 00:05:08.201076031 CEST	443	49732	104.26.12.205	192.168.2.4
Jul 26, 2024 00:05:08.201395035 CEST	443	49732	104.26.12.205	192.168.2.4
Jul 26, 2024 00:05:08.242806911 CEST	49732	443	192.168.2.4	104.26.12.205
Jul 26, 2024 00:05:08.257642984 CEST	49732	443	192.168.2.4	104.26.12.205
Jul 26, 2024 00:05:08.304506063 CEST	443	49732	104.26.12.205	192.168.2.4
Jul 26, 2024 00:05:08.366592884 CEST	443	49732	104.26.12.205	192.168.2.4
Jul 26, 2024 00:05:08.366657972 CEST	443	49732	104.26.12.205	192.168.2.4
Jul 26, 2024 00:05:08.366731882 CEST	49732	443	192.168.2.4	104.26.12.205
Jul 26, 2024 00:05:08.387226105 CEST	49732	443	192.168.2.4	104.26.12.205
Jul 26, 2024 00:05:09.257731915 CEST	49734	587	192.168.2.4	208.91.199.225
Jul 26, 2024 00:05:09.263462067 CEST	587	49734	208.91.199.225	192.168.2.4
Jul 26, 2024 00:05:09.263542891 CEST	49734	587	192.168.2.4	208.91.199.225
Jul 26, 2024 00:05:30.667756081 CEST	587	49734	208.91.199.225	192.168.2.4
Jul 26, 2024 00:05:30.667970896 CEST	49734	587	192.168.2.4	208.91.199.225
Jul 26, 2024 00:05:30.672717094 CEST	49734	587	192.168.2.4	208.91.199.225
Jul 26, 2024 00:05:30.680454016 CEST	587	49734	208.91.199.225	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 00:05:07.702933073 CEST	54205	53	192.168.2.4	1.1.1.1
Jul 26, 2024 00:05:07.714070082 CEST	53	54205	1.1.1.1	192.168.2.4
Jul 26, 2024 00:05:08.931281090 CEST	54745	53	192.168.2.4	1.1.1.1
Jul 26, 2024 00:05:09.256177902 CEST	53	54745	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 00:05:07.702933073 CEST	192.168.2.4	1.1.1.1	0x512a	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 00:05:08.931281090 CEST	192.168.2.4	1.1.1.1	0x497d	Standard query (0)	smtp.flying-fish-cn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 00:05:07.714070082 CEST	1.1.1.1	192.168.2.4	0x512a	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 26, 2024 00:05:07.714070082 CEST	1.1.1.1	192.168.2.4	0x512a	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 26, 2024 00:05:07.714070082 CEST	1.1.1.1	192.168.2.4	0x512a	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 26, 2024 00:05:09.256177902 CEST	1.1.1.1	192.168.2.4	0x497d	No error (0)	smtp.flying-fish-cn.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 00:05:09.256177902 CEST	1.1.1.1	192.168.2.4	0x497d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Jul 26, 2024 00:05:09.256177902 CEST	1.1.1.1	192.168.2.4	0x497d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Jul 26, 2024 00:05:09.256177902 CEST	1.1.1.1	192.168.2.4	0x497d	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Jul 26, 2024 00:05:09.256177902 CEST	1.1.1.1	192.168.2.4	0x497d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	104.26.12.205	443	7468	C:\Users\user\Desktop\LisectAVT_2403002A_124.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 22:05:08 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-25 22:05:08 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 22:05:08 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8a8f731ee853432b-EWR
2024-07-25 22:05:08 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	18:05:03
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_124.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_124.exe"
Imagebase:	0x2f0000
File size:	705'542 bytes
MD5 hash:	1E6FE7E9DD5292AC6ED4C77D742DA69B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1707848434.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1707848434.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:05:06
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_124.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_124.exe"
Imagebase:	0xee0000
File size:	705'542 bytes
MD5 hash:	1E6FE7E9DD5292AC6ED4C77D742DA69B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2912873981.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2914893392.0000000003341000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2914893392.0000000003341000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2914893392.0000000003367000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	174
Total number of Limit Nodes:	6

Executed Functions

Function 04D574BB Relevance: 1.1, Instructions: 1090COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709450480.0000000004D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549f8bdfa65b60528b23a0e830b593f81d1bd092039940b0be523d28e7318a6b
Instruction ID: 431a1fcf49fe30039f79f1deb7e82929fddc5a8fbb67983c5b881bd5a97af8e7
Opcode Fuzzy Hash: 549f8bdfa65b60528b23a0e830b593f81d1bd092039940b0be523d28e7318a6b
Instruction Fuzzy Hash: F4C2D534A11218CFDB55DF68C894AD9B7B2FF8A304F1141E9E909AB365DB31AE85CF40

Function 070A63E6 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2a029bd6a9bd84a71d290d5acfca6022e509fafbec91a54239451781644aa6
Instruction ID: ffe599928ccd109a4fafcd8adb5c4cb3dc222a598ac7ab5fce7a666c5c9121c4
Opcode Fuzzy Hash: 9a2a029bd6a9bd84a71d290d5acfca6022e509fafbec91a54239451781644aa6
Instruction Fuzzy Hash: 50C08095D9F054F6C91119C458000FDF73C95870A1F0C3252D22E63002410243340155

Function 070A4C6D Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 070A4EAE

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 77279826648b4bdce1bf9ab6c6fd40703c777944cd552385956f4312b62a4e9f
Instruction ID: 7600abd61a7bb2a2d5603279d569b3b56862074763dfd489f10fd6fec89214a7
Opcode Fuzzy Hash: 77279826648b4bdce1bf9ab6c6fd40703c777944cd552385956f4312b62a4e9f
Instruction Fuzzy Hash: A6A16BB5D0025ADFDB50CFA8C8417EDBBF2BF48314F1482A9E809A7250DBB49985CF91

Function 070A4C78 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 070A4EAE

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7caaf99a821baf55cb1beb8cc40620ed357f1c28fa3c843a453277d5ac969cba
Instruction ID: c22af762174316748e52dddd0008c6816f4196bc30e7616dee941432cd4ec49f
Opcode Fuzzy Hash: 7caaf99a821baf55cb1beb8cc40620ed357f1c28fa3c843a453277d5ac969cba
Instruction Fuzzy Hash: A8915BB5D0025ADFDB50CFA8C8417DDBBF2BF48314F1486A9E808A7254DBB49985CF91

Function 026FADE8 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 026FB03E

Memory Dump Source

Source File: 00000000.00000002.1707237070.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: df3cba09e99db3271da695cc2b9bec4a3002df1eb0d6e65640f9c242c29b8664
Instruction ID: ca46b5e611f1edc3ed49a414d84c445ed579883e7f5315417fb629e6a863a56f
Opcode Fuzzy Hash: df3cba09e99db3271da695cc2b9bec4a3002df1eb0d6e65640f9c242c29b8664
Instruction Fuzzy Hash: 43713270A00B058FDB64DF69D44475ABBF1FF88304F008A2DD58A9BB50E735E84ACB94

Function 026F590C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 026F59C9

Memory Dump Source

Source File: 00000000.00000002.1707237070.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5c87529c088e85c8ba28306a068d0a552d9374979dffb15e7c3b0da6aab7d71f
Instruction ID: 4938844ebb0371442a97a8e5a9643857474da3672d9504fd306fbeb7554748ae
Opcode Fuzzy Hash: 5c87529c088e85c8ba28306a068d0a552d9374979dffb15e7c3b0da6aab7d71f
Instruction Fuzzy Hash: 4141F2B0D00719CBDB24CFA9C9847DEBBB5BF48304F20806AD509AB255DB75698ACF90

Function 026F44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 026F59C9

Memory Dump Source

Source File: 00000000.00000002.1707237070.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b36b25f77a0aae2c4f72d0301a35688678b38cc2d5d80594bab052a9ef8906c9
Instruction ID: 461ec883da80b42e6cd3ef783f2d31f4252571761a3c1f19d0d4e86d3389bb7f
Opcode Fuzzy Hash: b36b25f77a0aae2c4f72d0301a35688678b38cc2d5d80594bab052a9ef8906c9
Instruction Fuzzy Hash: B441F1B0D00719CBDB24DFA9C884BDEBBB5BF48304F20806AD509AB255DB756945CF90

Function 04D54040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04D54101

Memory Dump Source

Source File: 00000000.00000002.1709450480.0000000004D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 54d80e90fb68e6c46868caaa5c52d372a3a06498c38b14cd06f5be0deb4001e1
Instruction ID: 32c11c462ef919857e9d267a554f826e6b86569e43f945011abab488ca29b095
Opcode Fuzzy Hash: 54d80e90fb68e6c46868caaa5c52d372a3a06498c38b14cd06f5be0deb4001e1
Instruction Fuzzy Hash: 78411AB8A00315DFDB14DF99C448B9ABBF5FB88314F24C459D519AB321D774A841CFA1

Function 070A49E9 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 070A4A80

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 72272ad4ee1578fde9ca04f6c4bc55356ba709b45e6c1fce35fcc9bfcacf5b0f
Instruction ID: b46ab4ea93942a06037cc9530c36d028c38b47dce15d93ca976ca923fa8cd67e
Opcode Fuzzy Hash: 72272ad4ee1578fde9ca04f6c4bc55356ba709b45e6c1fce35fcc9bfcacf5b0f
Instruction Fuzzy Hash: 102148B5900359DFCB10CFA9C885BEEBBF4FF48310F108429E959A7251D7789944CBA4

Function 070A49F0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 070A4A80

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6845b2506ebe24a9051347906b3b5971f53a2ad24e1b0603e778a1b85ed3fe19
Instruction ID: 1dcfca67cfabb97ce6cdbe260d5bb20df46cfb58b5bb5ed999de6469eca374cd
Opcode Fuzzy Hash: 6845b2506ebe24a9051347906b3b5971f53a2ad24e1b0603e778a1b85ed3fe19
Instruction Fuzzy Hash: 9F2127B59003599FCB10CFA9C885BDEBBF5FF48310F108429E959A7251D7789944CBA4

Function 070A4AD8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070A4B60

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b600641f6123248a1d23a609aac0ae2c9ccb2432126bf453e88a76e7df1c6d32
Instruction ID: e64e5a638f98173c715a727f067c0fc285b9af7f15ae0c5254158ab335feffa0
Opcode Fuzzy Hash: b600641f6123248a1d23a609aac0ae2c9ccb2432126bf453e88a76e7df1c6d32
Instruction Fuzzy Hash: C92125B1C003599FDB10DFA9C881BDEBBF5FF88320F108429E959A7251C7789940CBA0

Function 070A4850 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 070A48D6

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4dd1d59bb2f67dc20e6907df60d25a73ff1f731d2a025c83e4455bd1f1a7fe1b
Instruction ID: ac79d4d2bf330c20398622a73cdf8e76978656b99fe6403d766d93f6ff7f5bf6
Opcode Fuzzy Hash: 4dd1d59bb2f67dc20e6907df60d25a73ff1f731d2a025c83e4455bd1f1a7fe1b
Instruction Fuzzy Hash: 072157B5D003499FDB10DFAAC4857EEBBF4EF88324F10842AD459A7251C7789944CFA0

Function 026FD2BC Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,026FD696,?,?,?,?,?), ref: 026FD757

Memory Dump Source

Source File: 00000000.00000002.1707237070.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 45ba7382e5e5346b8bdbda986f274a7c0f18e5c2aadd699e6bc6cd8b96fde281
Instruction ID: e66290dad6f5f5801e7a43ec4346637960a4ec71e39bc614fa50b340c11b0d58
Opcode Fuzzy Hash: 45ba7382e5e5346b8bdbda986f274a7c0f18e5c2aadd699e6bc6cd8b96fde281
Instruction Fuzzy Hash: 9F21E3B5900249DFDB10CFAAD984ADEBBF5EB48310F14842AE918A7310D378A944CFA5

Function 070A4AE0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 070A4B60

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 147157ce6173cea04a1264cdd50b8f0e4df718cc01c7f2a8e08660ccb90c2a10
Instruction ID: f8c28db0d96fcd9a23dbf1d1fd390248ffb4710bfbd0e8e0f5d4dd04c80a9047
Opcode Fuzzy Hash: 147157ce6173cea04a1264cdd50b8f0e4df718cc01c7f2a8e08660ccb90c2a10
Instruction Fuzzy Hash: 8721E5B19003599FDB10DFAAC885ADEBBF5FF48320F108429E559A7250C7789544CBA4

Function 070A4858 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 070A48D6

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4c4b83a727a7e4524c15666a048c565e41c2b32aa5076fb42cb9b0f4529ce6d2
Instruction ID: 273987fb706fad6722ccc87a909df52e20cf97b7dba0f2a4d8daed636da43a15
Opcode Fuzzy Hash: 4c4b83a727a7e4524c15666a048c565e41c2b32aa5076fb42cb9b0f4529ce6d2
Instruction Fuzzy Hash: 922147B5D003499FDB10DFAAC4857EEBBF4EF48320F10842AE459A7240CB78A944CFA4

Function 026FD6CF Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,026FD696,?,?,?,?,?), ref: 026FD757

Memory Dump Source

Source File: 00000000.00000002.1707237070.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c8c1e3dd40870f7ed308cdd1192f5018e7c635e3ec50b7fd67f63c2c096f7e33
Instruction ID: 1c0b0577fe67ef8b002d5293c4f78a46943e3e9bf3182329197ad884a46a82bd
Opcode Fuzzy Hash: c8c1e3dd40870f7ed308cdd1192f5018e7c635e3ec50b7fd67f63c2c096f7e33
Instruction Fuzzy Hash: 4621C2B59002599FDB10CFAAD984ADEBFF4EB48320F14841AE958A7350D378A944CFA5

Function 070A4929 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 070A499E

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4fc250ae589a440765d0a0d2b5926f33b15bedb2ae80ff7779d65edf6d8d765e
Instruction ID: 38fe8ac855442e995d15389489984b0c447a2f4d4c11cfb89373ba950a5763bd
Opcode Fuzzy Hash: 4fc250ae589a440765d0a0d2b5926f33b15bedb2ae80ff7779d65edf6d8d765e
Instruction Fuzzy Hash: 561159B6900249DFCB10DFA9D845BEEBFF5EF88324F208829E955A7250C7759550CFA0

Function 026FB258 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,026FB0B9,00000800,00000000,00000000), ref: 026FB2CA

Memory Dump Source

Source File: 00000000.00000002.1707237070.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a501fcebdf061011aa0e08125758b63409da195e13bae44109f002a58d3535e7
Instruction ID: af6276f8cfd3bec76832e3bd15bf90d2c1e2005b743a819951163cc00f694741
Opcode Fuzzy Hash: a501fcebdf061011aa0e08125758b63409da195e13bae44109f002a58d3535e7
Instruction Fuzzy Hash: FF1126B6D002498FDB10CFAAD984ADEFBF4EB88314F10842ED519A7610C375A545CFA4

Function 026FA170 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,026FB0B9,00000800,00000000,00000000), ref: 026FB2CA

Memory Dump Source

Source File: 00000000.00000002.1707237070.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e145886818827103234f628c06ad0212683e40ce251f509d0a02acb743a3416c
Instruction ID: b482823dc546c8fc0e87d1f926afe670ce58b728c63777b78030cc1376881bc5
Opcode Fuzzy Hash: e145886818827103234f628c06ad0212683e40ce251f509d0a02acb743a3416c
Instruction Fuzzy Hash: 721114B69002499FDB10CF9AC584AEEFBF4EB88314F10842AE519A7210C375A545CFA4

Function 070A4930 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 070A499E

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 839e4705c642a69b47bac8b091d99431946ef49e04f8a48a4e3b6fd3bf77f838
Instruction ID: 10f801ad98c36f8ce57a3b498e6ec8df05355ceeb6035d97fcc322f313d0178e
Opcode Fuzzy Hash: 839e4705c642a69b47bac8b091d99431946ef49e04f8a48a4e3b6fd3bf77f838
Instruction Fuzzy Hash: 8B1137B59002499FCB10DFAAD844BDEBFF5EF88324F208819E555A7250C775A954CFA0

Function 070A436A Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 070A43D2

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: edc2fee6eaf0df1491551b7a789e4b7fd370ddd352d4b2d8edcdf768eabf1d82
Instruction ID: 8be39c990a8713fd3e086d78f342f750942a2f56c9804d7b9a0dc743cf38f890
Opcode Fuzzy Hash: edc2fee6eaf0df1491551b7a789e4b7fd370ddd352d4b2d8edcdf768eabf1d82
Instruction Fuzzy Hash: 471149B5D043898FDB10DFAAC4457AEFBF4EB88320F248829D459A7250C7796544CF94

Function 070A4370 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 070A43D2

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f4e4e2d9b9748d02d42976b588035d50035ca7762a555c01486d95b0999b9f14
Instruction ID: c700dda207d82f26e97730f7938ac6778f490fe7080ca8e33d67f48cc5dfd9ae
Opcode Fuzzy Hash: f4e4e2d9b9748d02d42976b588035d50035ca7762a555c01486d95b0999b9f14
Instruction Fuzzy Hash: A1113AB5D003498FCB10DFAAC4457DEFBF4EB88324F208819D559A7250C779A544CF94

Function 070A32F0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 070A7445

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 50f5f3e15b945a48cf6d542ce94327e9cb5bdaeddf325f85072c80f57e19cee6
Instruction ID: 0028f9eb2845068c6f99cc24d940ef4c7f4ccf82442a4cb06a5e45b1dc65354b
Opcode Fuzzy Hash: 50f5f3e15b945a48cf6d542ce94327e9cb5bdaeddf325f85072c80f57e19cee6
Instruction Fuzzy Hash: 5B1106B5900349DFDB10DF99C484BDEBFF8EB48314F109419E558A7210C3B5A944CFA5

Function 026FAFD8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 026FB03E

Memory Dump Source

Source File: 00000000.00000002.1707237070.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 50266426f447c2dc5f67b2da96ae00ddc913456b55bd3fa9cdfb5694b578fa0a
Instruction ID: f3710d8d4d333fa6d480f99abb9c7cfccee008cd17ce8e1dd50d1e0694fa905b
Opcode Fuzzy Hash: 50266426f447c2dc5f67b2da96ae00ddc913456b55bd3fa9cdfb5694b578fa0a
Instruction Fuzzy Hash: 46110FB5C002898FCB10CF9AD444BDEFBF4AB88328F10842AD529A7610D379A545CFA5

Function 070A73E0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 070A7445

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9b4791a312aac5614a26ab2a7eff0dc5c513086322bd4c858d671cf6e0bdbed0
Instruction ID: b4b24467d1bbbc7ec2d6ea23bfc83a5a1613b3ea2a7d0b7b7f158a9f85a35f7a
Opcode Fuzzy Hash: 9b4791a312aac5614a26ab2a7eff0dc5c513086322bd4c858d671cf6e0bdbed0
Instruction Fuzzy Hash: 6B11F2B5800249DFDB10DF99D885BEEBBF4FB48324F10851AE959A7610C375A984CFA1

Function 009AD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706220535.00000000009AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ad000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73fa8483ea76f392a13161b2f6d34c7f3af79be77967d4c435e0906ae34f064f
Instruction ID: 37275e432e491f5ecad42a2433d43761f238d7adf77e29e523b0b4d8ff13c2ef
Opcode Fuzzy Hash: 73fa8483ea76f392a13161b2f6d34c7f3af79be77967d4c435e0906ae34f064f
Instruction Fuzzy Hash: 23212871500204DFDB05DF14D9C4B26BFA9FB99314F20C569D90A4B6A6C33AE856C6E1

Function 009AD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706220535.00000000009AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ad000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443c7e9f840fade748852c34be7929d0e14459dd0c50f9eca083a5f74766e3db
Instruction ID: fc21290ea9bec511794af0fe54eedbe6c3847135a19448be8f6ea40970fc1e5e
Opcode Fuzzy Hash: 443c7e9f840fade748852c34be7929d0e14459dd0c50f9eca083a5f74766e3db
Instruction Fuzzy Hash: 8E213771904240DFDB05DF14D9C0B2BBFA5FB99318F24C569E80A0B65AC33AD856DBE1

Function 009BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706292030.00000000009BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bd000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95246c67a7b5da18d3bac0699d33015ad3c8393a12dac4f9d965aa2ccf24aad2
Instruction ID: 5eff6271012947e322346a8c2fc41a748b55f44844b8e04e1cd5c654d0d9a7a9
Opcode Fuzzy Hash: 95246c67a7b5da18d3bac0699d33015ad3c8393a12dac4f9d965aa2ccf24aad2
Instruction Fuzzy Hash: 0F213471604200DFCB14EF14DAC4B66BFA5FB88324F20C96DD80A4B296D33AD847CA61

Function 009BD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706292030.00000000009BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bd000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e28546ad21586912ab873dae38404080a5c8355eb4eb30b0f04df71d9dc531
Instruction ID: ea93431f941d49b82e0356b533e074c2fcd4ef6085636931c32b94a33f08b7a1
Opcode Fuzzy Hash: 14e28546ad21586912ab873dae38404080a5c8355eb4eb30b0f04df71d9dc531
Instruction Fuzzy Hash: FB212671504284EFDB05DF14DAC0B66BBA5FB84324F20CA6DE8194B296D33AD846CB61

Function 009AD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706220535.00000000009AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ad000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: b99f834f181d4fdc14fc318b870899bb44c9e8d6191c00ae17c855b7a2f403b5
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 3D110676404240CFDB01CF00D5C4B16BFB1FB98314F24C2A9D80A0B666C33AD456CBD1

Function 009AD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706220535.00000000009AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ad000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: cdb6e66349bd41fe9d99d637cc1d5ab7286f59edce92ba2a5abbc769623f725a
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 5E11E676904280CFDB16CF14D5C4B16BF71FB94318F24C6A9EC4A0B65AC336D95ACBA1

Function 009BD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706292030.00000000009BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bd000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: da28b4c941d4d99fa20e95bf7a2a83fcb26e087ebb62c906ca85ddda078d49fc
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 1D11BB75504284DFDB02CF10C6C4B55BFA1FB84324F24C6AAD8494B296C33AD80ACB61

Function 009BD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706292030.00000000009BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9bd000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 6e729ddd3ef9c79037584ceac1ef4ade1cce5fb506a906f5b9ac18e27fb8d419
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 0C11DD75504280CFCB11DF14D6C4B56FFA2FB84324F28C6AAD8094B656C33AD80ACBA2

Function 009AD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706220535.00000000009AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ad000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6351c45df4594372af50cd7e1f052e29c2bd98ce86665f38bfcc2eb79c4074ea
Instruction ID: 10569c20de3ab2eda700ca3964f3c08c25a67451f59741af94e0683dcef4ee44
Opcode Fuzzy Hash: 6351c45df4594372af50cd7e1f052e29c2bd98ce86665f38bfcc2eb79c4074ea
Instruction Fuzzy Hash: 4101DBB100A3409AE7155E25CD88B67BFDCDF46324F18C92AED0A4E696D67DD840CAF1

Function 009AD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706220535.00000000009AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9ad000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328d1a7bd7bb4792dfc16224ab0477f8aec41678872bf29839eff5bfe0f6196
Instruction ID: 4f660adeaffee2b59dfa27df4c99e5aeacb0c29c8af36976ea6777b97a06d842
Opcode Fuzzy Hash: 5328d1a7bd7bb4792dfc16224ab0477f8aec41678872bf29839eff5bfe0f6196
Instruction Fuzzy Hash: 92F062714053449AE7148E16C888B62FFACEB55734F18C45AED494E696C2799844CBB1

Non-executed Functions

Function 070A8DA8 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe36d8aeb4aaea69e1c48cefa7a070440de33f6f7f669dd89688103889ec9ae
Instruction ID: 9a594240f1dc015779d7dd5e7bbfa83c7eab1d7063e0ecb031f0c7c7c169fa91
Opcode Fuzzy Hash: abe36d8aeb4aaea69e1c48cefa7a070440de33f6f7f669dd89688103889ec9ae
Instruction Fuzzy Hash: DBE199B0B016059FDBAADBB5C450BAEB7F6AF89300F14856DD149DB3A0DB35E801CB51

Function 070A1EA0 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd154444ba9e75c3e7169524c05862f5d5c4b60571111b38373c5fa40da55c46
Instruction ID: 9eddb8d39fed40e83243df6c8bee52898e0713dcad3945aeb6f37658fa2b7a15
Opcode Fuzzy Hash: cd154444ba9e75c3e7169524c05862f5d5c4b60571111b38373c5fa40da55c46
Instruction Fuzzy Hash: CDE1F9B4E006599FCB14DFA9C5809AEFBB2FF89304F24C269E414AB356D730A941CF61

Function 070A1A6A Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2cbe2a79efb9a651204769f3ad5f597941bfb757f0401dd1a3dc2dd98ead4e
Instruction ID: e149ad59bf7fa29769b56954a40cca1fdb26136f7f7626aa37e4a5df6890c90e
Opcode Fuzzy Hash: 8d2cbe2a79efb9a651204769f3ad5f597941bfb757f0401dd1a3dc2dd98ead4e
Instruction Fuzzy Hash: 25E1DBB4E012599FCB14DFA9C5809AEFBF6FF89304F248259E414AB356D730A941CFA1

Function 04D50040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709450480.0000000004D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b140943f0810eaa12b7b6fa35b83b296f62ecde57eb5984426aa1eb3302b9016
Instruction ID: 6a8a640181adb1b48708c2d9b9781b368fe1bc8128242d786867db1742682daf
Opcode Fuzzy Hash: b140943f0810eaa12b7b6fa35b83b296f62ecde57eb5984426aa1eb3302b9016
Instruction Fuzzy Hash: 4B12A7B0C927468AD318CF6EE98D1897BB1BFC5318BD0CA09D1A12F2E5D7B4116ACF44

Function 070A4420 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3d22149b16f4bffa5377fad7bc5c835f83c27b89cb7415966c250e3226ef12
Instruction ID: 994f7f93c337e7d400b7169a97487b15b0030b698688700e558d24802cb5cb6c
Opcode Fuzzy Hash: 5d3d22149b16f4bffa5377fad7bc5c835f83c27b89cb7415966c250e3226ef12
Instruction Fuzzy Hash: A5E1ECB4E002599FCB14DFA9D5809ADFBF2FF49304F248269E414AB356D770A941CF61

Function 070A3B48 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb72c7aa03cc90cb55a5a108feb7ceee7a15bf12255c7fa126e295e11c6540ad
Instruction ID: 5a066671f9f99f27a06ead242ffdce4ff7063147596bb3c6dd8c7d5c5238abf5
Opcode Fuzzy Hash: fb72c7aa03cc90cb55a5a108feb7ceee7a15bf12255c7fa126e295e11c6540ad
Instruction Fuzzy Hash: 37E1E9B4E002599FCB14DFA9D5809AEFBF2FF89304F248269E415AB356D731A941CF60

Function 070A22E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e100d3ce80c239a609279b9fe9ab210cdbc2e6c60baadde7c6e681240684ec
Instruction ID: 38a4fe19e966fe1d09711d52df33d52cd24398525d1a9f837aeaefb2c2b80ba9
Opcode Fuzzy Hash: d9e100d3ce80c239a609279b9fe9ab210cdbc2e6c60baadde7c6e681240684ec
Instruction Fuzzy Hash: 3BE1D8B4E012199FCB14DFA9D5809AEFBF2FF89304F248269E415AB356D730A941CF60

Function 026FD5FC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707237070.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa934748bb31103315e53103036cb135c511fe0669daaa521147794c33977f1b
Instruction ID: f32cbc015b7e1577521b44d34b4d4a7aa5982740009bf28551531a1cc7c7b98d
Opcode Fuzzy Hash: fa934748bb31103315e53103036cb135c511fe0669daaa521147794c33977f1b
Instruction Fuzzy Hash: 27A19F36E002058FCF15DFB4C88059EB7B2FF84304B25856AEA01AB7A5DB71E956CF80

Function 04D50006 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709450480.0000000004D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138c847578627fb9ca8809df3eade23f6a346119657a8769a93fb895c1a9cde5
Instruction ID: 479fcc06f43705e1661567176fac69419d9bef782af4a519ac09ff7281172a04
Opcode Fuzzy Hash: 138c847578627fb9ca8809df3eade23f6a346119657a8769a93fb895c1a9cde5
Instruction Fuzzy Hash: 7BC13BB0C827468FD718CF6EE9891897BB1FFC5314B908B09D1A16B2E1DBB4156ACF44

Function 070A1EB0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711219603.00000000070A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70a0000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e301e24d2352941373fa3763213b4c1b3b6eec444c8c311a746af2e740a57d
Instruction ID: ddb212c7e381014644ded24cc44ea22c420382e55f55d1a101f49a2abaee5067
Opcode Fuzzy Hash: 86e301e24d2352941373fa3763213b4c1b3b6eec444c8c311a746af2e740a57d
Instruction Fuzzy Hash: 2A51FBB4E002198BCB14DFA9C5805AEFBF6FF89304F24C169D518A7316D731A941CF61

Analysis Process: LisectAVT_2403002A_124.exePID: 7468, Parent PID: 7292COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06F6B2C0 Relevance: 8.3, Strings: 6, Instructions: 763COMMON

Download Yara Rule

Strings

$kq, xrefs: 06F6BC6F
$kq, xrefs: 06F6BC63
$kq, xrefs: 06F6BC07
$kq, xrefs: 06F6BBFB
$kq, xrefs: 06F6BC3B
$kq, xrefs: 06F6BC2F

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: d3dbc4caf1d98f794e149dfc456b7865b031c8b45e6dd0bb0c3ff4144e62b1ee
Instruction ID: 14a0df83b472898e36c6d577d2b4495eaa1f4ee6f4731e94fe29805ff0bdf69b
Opcode Fuzzy Hash: d3dbc4caf1d98f794e149dfc456b7865b031c8b45e6dd0bb0c3ff4144e62b1ee
Instruction Fuzzy Hash: BE529030E102098FDF64CB6AD5907AEB7B6FB85310F20892AE405EB395DB35DD91CB91

Function 06F63138 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06F63867
$kq, xrefs: 06F6385B
$kq, xrefs: 06F6381A
$kq, xrefs: 06F6380E
$kq, xrefs: 06F63837
$kq, xrefs: 06F63843

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: e9103f0c192db2126e49774a5d583395fb5dca5f0010e887e4911eec5699d1cd
Instruction ID: 8812aa0ad541a8e7d2394ae7497510cf6b7719fd7c70d8a5519f1824b49a02f1
Opcode Fuzzy Hash: e9103f0c192db2126e49774a5d583395fb5dca5f0010e887e4911eec5699d1cd
Instruction Fuzzy Hash: 19324C31E1071A8FDB14DF75D99459DB7B6FFC9300F2096A9E409AB264EB30A985CB80

Function 06F67E18 Relevance: 3.0, Strings: 2, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06F68155
$kq, xrefs: 06F68161

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 2a2f8dc9306ff44927ae208cf8c1ebb875e766a7827e4bde3f47df0a77e38faf
Instruction ID: cf4d248c534eaed68113aae217de0e6c354ae47b82eda2cc42f9efd28228563c
Opcode Fuzzy Hash: 2a2f8dc9306ff44927ae208cf8c1ebb875e766a7827e4bde3f47df0a77e38faf
Instruction Fuzzy Hash: A202BC30F002058FDB54DB66D550AAEB7F6FF84350F248968E4269B3A4DB35EC86CB90

Function 06F66690 Relevance: .8, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8c75081f748c011cf69d017ec45bed1d7dca8998a7c8654ac84e3ee0b3c743
Instruction ID: 0eebbb11e7e71295505298308d993b25703f58541f722b04f35e1a18baaca414
Opcode Fuzzy Hash: 7f8c75081f748c011cf69d017ec45bed1d7dca8998a7c8654ac84e3ee0b3c743
Instruction Fuzzy Hash: 1462BF30F002059FDB54DB69D654AADB7F6EF88314F148469E806EB3A4DB35EC41CB91

Function 06F6C208 Relevance: .6, Instructions: 627COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 879c64c6b21349633436f952896e2e187ecc1fde0c3ff82a5b9e27e669feb595
Instruction ID: e4a587ce91a1f5550338c5a2284615f38c022f4a4ead61e78408a9669230aa1a
Opcode Fuzzy Hash: 879c64c6b21349633436f952896e2e187ecc1fde0c3ff82a5b9e27e669feb595
Instruction Fuzzy Hash: 4D326D34F102098FDF54DBA9E990BADB7B6FB88314F108925E485EB395DB35EC418B90

Function 06F65680 Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0213b7c79655c229aab414475f3a39407f23e217ce5565fa82a11ca4992c2901
Instruction ID: 22288c6e829ae5e510999a6c140c3c745839e8356006137819d0e7d7314d34ed
Opcode Fuzzy Hash: 0213b7c79655c229aab414475f3a39407f23e217ce5565fa82a11ca4992c2901
Instruction Fuzzy Hash: EC12D271F102158FDF60DB76D98066EB7B6FF85320F248429E856AB398DA34EC41CB90

Function 06F6AD58 Relevance: 10.4, Strings: 8, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06F6AED8
$kq, xrefs: 06F6AE85
$kq, xrefs: 06F6AE79
$kq, xrefs: 06F6AEFB
$kq, xrefs: 06F6AECC
$kq, xrefs: 06F6AF30
$kq, xrefs: 06F6AF24
$kq, xrefs: 06F6AF07

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: 6782100289507678e479b72e7888d379628125d3573626c7f0cae0559ad93595
Instruction ID: 5649ec0185c26efa48ad8c6013456ddf1374d0aeeefe4a8d43b7280e1499719f
Opcode Fuzzy Hash: 6782100289507678e479b72e7888d379628125d3573626c7f0cae0559ad93595
Instruction Fuzzy Hash: F3E15D30E1020A8FDB65DBAAD5406AEB7F6FF85310F208529E405EB354DB35EC46CB91

Function 06F691E0 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06F69262
$kq, xrefs: 06F69233
$kq, xrefs: 06F69227
$kq, xrefs: 06F6926E

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 048c5f65655fd16b4a149dd2d877a7ded35415d8d28fa8599fcfb95c080dd069
Instruction ID: 860a5ed993faed4160b940f03c5439630dcbfe7725b37d89c492a5c1dc9202a6
Opcode Fuzzy Hash: 048c5f65655fd16b4a149dd2d877a7ded35415d8d28fa8599fcfb95c080dd069
Instruction Fuzzy Hash: B2913030F1021B8FDB54DF65D9507AEB7FAEB88350F108569D409EB398EA78ED418B90

Function 06F64C48 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPpq, xrefs: 06F64D75
\Opq, xrefs: 06F64DFF
fpq, xrefs: 06F65355

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: fpq$XPpq$\Opq
API String ID: 0-2571271785
Opcode ID: 70a13a384eadcabd19727a2aead1f5bf2b12fcc780d2456a83f3beaca93fe0cb
Instruction ID: 570a77974e7b1f9133c8eb9f24a8093bc0fa46f01948abd8b41de71e2da7698d
Opcode Fuzzy Hash: 70a13a384eadcabd19727a2aead1f5bf2b12fcc780d2456a83f3beaca93fe0cb
Instruction Fuzzy Hash: B0618270F002199FEB54ABB5C8157AEBAF6FF88710F208429E506AB394DB759C45CB50

Function 06F691D3 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 06F69262
$kq, xrefs: 06F69227

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: c16ce5ee6144bf50d2ac1b538be2ec7993d1a428f87246ad4aac1898fdac596f
Instruction ID: eb7af31ff1e3bcd2dc5c46fd0c073d8093b8a4b6f0c2c6fd349270c182c497eb
Opcode Fuzzy Hash: c16ce5ee6144bf50d2ac1b538be2ec7993d1a428f87246ad4aac1898fdac596f
Instruction Fuzzy Hash: E0513F30F002068FDB54DF75D9A0B6E77FAEB88750F508569D509DB398EA78EC418B90

Function 0190E758 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,0190EBBA), ref: 0190ECA7

Memory Dump Source

Source File: 00000002.00000002.2914143226.0000000001900000.00000040.00000800.00020000.00000000.sdmp, Offset: 01900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1900000_LisectAVT_2403002A_124.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 6119b8e3c8be41a65bfc726f72acc5e14edc15326f2e593bc4579bdded4a8f14
Instruction ID: 6f7657de6f16ceb36ba8d64d07f89509bc1caa02cf36f02f1f0d1d3d752f4350
Opcode Fuzzy Hash: 6119b8e3c8be41a65bfc726f72acc5e14edc15326f2e593bc4579bdded4a8f14
Instruction Fuzzy Hash: 601103B1C006699FCB10DF9AC545B9EFBF4EB48320F14856AE918A7240D379A944CFA5

Function 06F64C38 Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPpq, xrefs: 06F64D75

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: XPpq
API String ID: 0-1266478781
Opcode ID: 0b2da5fca88bead8b61d91eab0f25fb29953060b572bdb2463a2a77592f176f5
Instruction ID: b331f75a46a35a8f81009c28d5b1420acad1df60c87f6b504ce2436b6462ffe3
Opcode Fuzzy Hash: 0b2da5fca88bead8b61d91eab0f25fb29953060b572bdb2463a2a77592f176f5
Instruction Fuzzy Hash: 4F418471F002099FEB54EFB5C814BAEBAF6FF88710F208529E506AB395DA759C05CB50

Function 06F64C40 Relevance: 1.4, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPpq, xrefs: 06F64D75

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: XPpq
API String ID: 0-1266478781
Opcode ID: 0215be5a2642669bf4ccf2b9a2f754d82226e4041f017b71a8e3f21d59d39f7a
Instruction ID: 32c1b096d7ad01dbfc6f2e80446a05ae8014702ea095615e09e998e84f837209
Opcode Fuzzy Hash: 0215be5a2642669bf4ccf2b9a2f754d82226e4041f017b71a8e3f21d59d39f7a
Instruction Fuzzy Hash: 8F418370F002099FEB55EFB5C814BAEBAF6FF88710F208529E505AB398DA759C01CB50

Function 06F64C3C Relevance: 1.4, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPpq, xrefs: 06F64D75

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: XPpq
API String ID: 0-1266478781
Opcode ID: f9653dbddca0e88fc4dc68345833442a47946a02fd0391dc2ceb4813615ae78c
Instruction ID: abeea4c47deb35ea3ab66ee1cc3371cc18c25b4955f2d7d38423968f4ae7058f
Opcode Fuzzy Hash: f9653dbddca0e88fc4dc68345833442a47946a02fd0391dc2ceb4813615ae78c
Instruction Fuzzy Hash: C7416370F002099FEB55DFA5C9147AEBBF6FF88300F208529E106AB395DA759C45CB50

Function 06F6DB40 Relevance: 1.4, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHkq, xrefs: 06F6DC89

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: d53d87adf542091cfb7c443ca323d0e62d4777d3d64102f72236714b8ae17005
Instruction ID: 1cbb97807b11d2fb311cd0e43eaf9d3fb00a3cf5ebf215dc61fb015d7523eba4
Opcode Fuzzy Hash: d53d87adf542091cfb7c443ca323d0e62d4777d3d64102f72236714b8ae17005
Instruction Fuzzy Hash: B4418170F0020A9FDB65DF66D9546AEBBB6FF85340F204929E406EB344DB74E846CB81

Function 06F622A0 Relevance: 1.4, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHkq, xrefs: 06F623DB

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: dedf06999532c595517aed2a6440021f6ee41820b7a4ed6266dab80a674c65ee
Instruction ID: d17b4958c9839ad99dca43bc0afe08471dd6b8d7362f95d52adc181e9464767c
Opcode Fuzzy Hash: dedf06999532c595517aed2a6440021f6ee41820b7a4ed6266dab80a674c65ee
Instruction Fuzzy Hash: CA310230F002018FDBA59B35D95566F7BEAFB89210F209928E402DB398DF35DE46C795

Function 06F68108 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

$kq, xrefs: 06F68155

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq
API String ID: 0-3037731980
Opcode ID: 7959ed90dfb307a590bef45b25fdeebe48dbc50cd4e83fcef04cf338e77a8ba1
Instruction ID: 4307415e4d0fb852349f76a40a4e7c15e5e98011c29d36d855be5b664953c3b9
Opcode Fuzzy Hash: 7959ed90dfb307a590bef45b25fdeebe48dbc50cd4e83fcef04cf338e77a8ba1
Instruction Fuzzy Hash: 4801F732E102189FDB249E66DD856AAB77AFB40390F18442DF821D3250C7749D45C7A0

Function 06F68110 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

$kq, xrefs: 06F68155

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq
API String ID: 0-3037731980
Opcode ID: 78e6a8af4c7d4683ce2f325a9e749c27696de81070a178dd1287e9fd56e3190c
Instruction ID: 141499ef1224775352847606693b31a499e2c2f42210f83882032ff3ac88fc7e
Opcode Fuzzy Hash: 78e6a8af4c7d4683ce2f325a9e749c27696de81070a178dd1287e9fd56e3190c
Instruction Fuzzy Hash: 0501D636E102189FDB648E66DD446AAB7BAFB403A0F18447DF831D3250C6749D45C7E0

Function 06F62BC5 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b869ac474f0ca7111fef0d013d8bf7ebf2bf06ae3305cd5ee9ca11eecd611402
Instruction ID: b845bab8c506667457418b73ea7ce58312dc2671846e664c432820b8b0eb95eb
Opcode Fuzzy Hash: b869ac474f0ca7111fef0d013d8bf7ebf2bf06ae3305cd5ee9ca11eecd611402
Instruction Fuzzy Hash: DA026531E002048FDB64DB65C584A5DFBF2FB84318F54C4A9E85AAB365DB35EE85CB80

Function 06F6B2B2 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192d13b1fd59020d6663cc852704bb12e807fd5d57ed6548122694aefc480143
Instruction ID: f726f37e81a60753a79032a479ff6877b17e204fb5adfdc6d5ca891d05ab6fbb
Opcode Fuzzy Hash: 192d13b1fd59020d6663cc852704bb12e807fd5d57ed6548122694aefc480143
Instruction Fuzzy Hash: A3A15230F102098FEF64DB5ED5907AE77BAEB89310F604825F409EB399DA35DC918751

Function 06F6B6C8 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8bbdeed4d988e169411ed3d366a5aa7dbf18dd9b3639cd7594731cddae164b
Instruction ID: f1bc3c308643e9805f6aa5b60bb37ff5fbafb785f7490a8f9b807c1e99bfefbb
Opcode Fuzzy Hash: 2e8bbdeed4d988e169411ed3d366a5aa7dbf18dd9b3639cd7594731cddae164b
Instruction Fuzzy Hash: 7FA14970E0060A8FDBA0CB6AD5807ADB7B1FB45314F648926F419DB265DB34EC92CB91

Function 06F6B6D0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5c5cfe47bdcbb745878da9208ce6b0d110455db5220e9ab4c12fa052bb321b
Instruction ID: 98f88c18fa751028a08c46dcf901594d8c7571ec447e9688951f05dee59b003a
Opcode Fuzzy Hash: 4d5c5cfe47bdcbb745878da9208ce6b0d110455db5220e9ab4c12fa052bb321b
Instruction Fuzzy Hash: F4A14970E0060A8BDBA0CB6AD5807ADB7B1FB45314F608926F419DB265DB34EC91CB91

Function 06F66290 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b29f394ca2353e259084e2f539a0ab52286e4dc250397e78b0d9902088fe047
Instruction ID: dc617227c6f9b95139a522acbbf0afb4411ef6ff04bf975f558898d348c8b883
Opcode Fuzzy Hash: 4b29f394ca2353e259084e2f539a0ab52286e4dc250397e78b0d9902088fe047
Instruction Fuzzy Hash: D661E4B2F001214FDF519A7EC98066EBAEBEFD4620B144439E40ADB378DE65DC028791

Function 06F64378 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cffb8277b80cd403bb9095bd70e9d9f1325df708c8ee123784d623ed22945aa
Instruction ID: 328c5f0235fea04d5350579a8273bde308dea1f8f099babdae40f42fb2945a46
Opcode Fuzzy Hash: 4cffb8277b80cd403bb9095bd70e9d9f1325df708c8ee123784d623ed22945aa
Instruction Fuzzy Hash: 80813C30F002098BDF54EFA9D5557AEB7F6EB89310F108529E40ADB398EA75DC428B91

Function 06F64698 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90be7c717b751e2806fa2a772b7151aaac98b8c5e29c0335e879786781ad0030
Instruction ID: 838d227dffacf72f14eb1be16cf201a9e77b5c86e61c57a2c8e652b7619d567c
Opcode Fuzzy Hash: 90be7c717b751e2806fa2a772b7151aaac98b8c5e29c0335e879786781ad0030
Instruction Fuzzy Hash: 49913E34E1021A8FDF60DF69C850B9DB7B1FF89310F20C599E549AB295DB70AA85CF90

Function 06F64388 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2d5acdf4cdace7a01138eb1ee976fa36710dc3a038473ed5f2700582119460
Instruction ID: 44533706cdaa74c4d46b407a70aefa58e6782da4c73d3cde0a32ae7840e61179
Opcode Fuzzy Hash: 6e2d5acdf4cdace7a01138eb1ee976fa36710dc3a038473ed5f2700582119460
Instruction Fuzzy Hash: DC811C30F102098BDF54EFA9D55476EB7F6EB89310F108529E40AEB398EB75EC428B51

Function 06F64384 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655772e21727b9780220c18d4b63c4f0958b262a671589690b8837a53d41ab51
Instruction ID: 72c8598396f587a8bc13e0e5e81efe79aea7f9cec5e39d376dfa1a41a7df3be1
Opcode Fuzzy Hash: 655772e21727b9780220c18d4b63c4f0958b262a671589690b8837a53d41ab51
Instruction Fuzzy Hash: D9813C30F0020A8BDF54DFA9D55476EB7F6EB89310F108929E40AEB398EB75DC428B51

Function 06F646B0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fbcd1e3dbf6e0c664a74cce503dcd964490468be1ed620840bab689b1544c8d
Instruction ID: 685e47490d1d8fba17489f7ed08e1b386338a2d36eaa3a8f9d9ae6c7ac313410
Opcode Fuzzy Hash: 8fbcd1e3dbf6e0c664a74cce503dcd964490468be1ed620840bab689b1544c8d
Instruction Fuzzy Hash: 09913D30E1021A8BDF60DF69C950B9DB7B1FF89310F20C599E549AB295DB70AA85CF90

Function 06F646A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba43d026ffe448fe2e296946619dd63d98fd806dd7a7a56b0066fa097142eb8
Instruction ID: ae64571ecdfce3c14718d4ae448a925a9b9b81e068abd2215ebd8db145c6943d
Opcode Fuzzy Hash: dba43d026ffe448fe2e296946619dd63d98fd806dd7a7a56b0066fa097142eb8
Instruction Fuzzy Hash: 67914E34E1021A8BDF60DF65C950B9DB7B1FF89310F20C599E549AB294DB70A985CF90

Function 06F6EBA0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1f8650ce75f3bbaadcce6b58e10505593b0cd1f74b48c681253f0feed18211
Instruction ID: 2e6daed9acdff5c98cf94c3e7e78b79eff11862c81c62311e3fdb50e0eaaf435
Opcode Fuzzy Hash: df1f8650ce75f3bbaadcce6b58e10505593b0cd1f74b48c681253f0feed18211
Instruction Fuzzy Hash: 37712775E002099FDB55DBA9D980A9EBBF6FF88310F248429E405EB355DB30EC46CB50

Function 06F6EB90 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4c93df5cdfea4e024c57bbbc9d7c9ab6713436382b66d5372c560bed361ce6
Instruction ID: f228c52c85423e63f00999b2bc3d607abb5c833671449c0243bffd3a65cc4856
Opcode Fuzzy Hash: 5e4c93df5cdfea4e024c57bbbc9d7c9ab6713436382b66d5372c560bed361ce6
Instruction Fuzzy Hash: B4712975E002098FDB55DFA9D980A9DBBF6FF88310F648469E405EB2A5DB30EC46CB50

Function 06F6FAB1 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd59ce02e80c13e56a4e0a3d1b3590087b14b67c082c09dd503cf5bcb7eb0f6c
Instruction ID: d7ba1aa02c9cbd4f25c1cd614962e219b2d7513ef80b0d3927e3c49de1b8a442
Opcode Fuzzy Hash: bd59ce02e80c13e56a4e0a3d1b3590087b14b67c082c09dd503cf5bcb7eb0f6c
Instruction Fuzzy Hash: 8151D670F212059FEF64567DE958B7F3A5BE789320F20043AF40AD73A5C969CC8587A2

Function 06F6FD10 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72df480cbd32cd43e28c9c75b5bed663b99f158a09a3d4dc840df77f60ac990a
Instruction ID: 357e78bcb9c092a153af0cdc04e984b07f5b2b333321e79fa37fb2925c3ed54d
Opcode Fuzzy Hash: 72df480cbd32cd43e28c9c75b5bed663b99f158a09a3d4dc840df77f60ac990a
Instruction Fuzzy Hash: 8951F031E02109DFCB64ABBAF9446ADBBB3FF89311F108979E006D7251DB359855CB80

Function 06F6FAC0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 748c746822b8e305943e27c597b34eadada332fe1c56d0b39196e3fc0149cc89
Instruction ID: 71c141fa8cef92d0fb84ee4a86decf63c0e19df5afc7f7f8126cf42dc9c52e99
Opcode Fuzzy Hash: 748c746822b8e305943e27c597b34eadada332fe1c56d0b39196e3fc0149cc89
Instruction Fuzzy Hash: 4951C270F212058FEF64566DE958B2F365BE789320F20483AF40BD73A8C969CC8547A2

Function 06F65670 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a557142bd07d2546002697ffada2605e2ef1c10266d74a92ee2af67e4da347c2
Instruction ID: 767b7035525b11b2d5b5c67fc6cacc446015f5f4450968fa4c799b6b16de4c25
Opcode Fuzzy Hash: a557142bd07d2546002697ffada2605e2ef1c10266d74a92ee2af67e4da347c2
Instruction Fuzzy Hash: 0B4176B5E102098BDF75CB6AC880B7EFBB1FB45310F24C92AE456EB651C634E841DB51

Function 06F65500 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5790b99374e1e254e2e114dfc44ce76fb001cd13ee5fed0213abbdb6ab9da6b
Instruction ID: 20dc73188f46447b15164561b4a26bb671e56d8323af964e726e77e8dd2f97cf
Opcode Fuzzy Hash: d5790b99374e1e254e2e114dfc44ce76fb001cd13ee5fed0213abbdb6ab9da6b
Instruction Fuzzy Hash: 13415171E006098FDF70CE9AD884AAFF7B2FB95314F10492AE116E7650D731E945CB91

Function 06F62150 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edbad43be9d888f007082d4a8f2c310cf9ba143d341c07c885a26234bd5ed449
Instruction ID: 033afaae229c35995d45a528651a9e8110568d2007bcb214074236e73829a493
Opcode Fuzzy Hash: edbad43be9d888f007082d4a8f2c310cf9ba143d341c07c885a26234bd5ed449
Instruction Fuzzy Hash: 3B317A35E102159FDB54CF65D894A9EBBB2FF89310F108529E906EB354DB31ED42CB40

Function 06F62160 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ace1a99a6004682cc0c4ad6c9fb78162e3c90c368f41d904bc8f4b322d3b56c
Instruction ID: 0db14e53c3a4fb7a47a5b3091460841ad032f7cbc33804a77be29a64c218f419
Opcode Fuzzy Hash: 8ace1a99a6004682cc0c4ad6c9fb78162e3c90c368f41d904bc8f4b322d3b56c
Instruction Fuzzy Hash: 43317E34E102059BDB14CFA5D894A9EB7B2FF89310F108529E906FB354DB71ED42CB40

Function 06F6D9F5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b1431727d70dd20eaaeb36e0e58b66c863792d1e2f848c32afbf0d4a74a991
Instruction ID: ffdab8bee8a8fe6d40a481a71cdf4c2826759ad2da08baef1316ab474cc07e95
Opcode Fuzzy Hash: 95b1431727d70dd20eaaeb36e0e58b66c863792d1e2f848c32afbf0d4a74a991
Instruction Fuzzy Hash: 7D318430F1420A8FDF65DF69D58069EBBB5FF84314F108929E401EB355EB70E9868B80

Function 06F63B78 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87414abc9dff3034b8f3154eb2a273304b1b023eae7960d2a12cd2dba2bd47d2
Instruction ID: d5d744222a11be195751fdfd2b2f32c59fc951c482d7a613a950c5824f5c069c
Opcode Fuzzy Hash: 87414abc9dff3034b8f3154eb2a273304b1b023eae7960d2a12cd2dba2bd47d2
Instruction Fuzzy Hash: E4216B72F106159FEB50CF7AE940AAEBBF9EB88710F109025E905E7354E734D9418B90

Function 06F63B80 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6abf480e9d4668afe25fe3c0330cf364a8c9811020b323d15bb4b560f1735239
Instruction ID: b50112aa74687c8a72fa9a3ef170cabf0aaa20d13dc5bfb318b85d8feb336e8d
Opcode Fuzzy Hash: 6abf480e9d4668afe25fe3c0330cf364a8c9811020b323d15bb4b560f1735239
Instruction Fuzzy Hash: FF214A72F106159FEB50CF7AE980AAEBBF9EB88710F109125E905E7354E734DD418B90

Function 06F63B88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6629055dbe7b79fb3463a7a0955cf56b5d9f8d4d468cce37b8af9aed7725d340
Instruction ID: 7bda989f2054ec4147774a2d0a8e1f845b0080e85250cf7539ba632ca2f38f82
Opcode Fuzzy Hash: 6629055dbe7b79fb3463a7a0955cf56b5d9f8d4d468cce37b8af9aed7725d340
Instruction Fuzzy Hash: 0C217C76F006159FEB50CF7AE980AAEB7F5EB48710F109129E906E7350E734DD418B90

Function 06F63B7C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2496a3450d9c99ed84c2747ee21a3f9b56d78b8bf0479fcf723e4ec3e42bad7f
Instruction ID: 51b1065ddcb3f5ebea90f48c7b063687c679fc8d50132aaafb9bd79530d56c54
Opcode Fuzzy Hash: 2496a3450d9c99ed84c2747ee21a3f9b56d78b8bf0479fcf723e4ec3e42bad7f
Instruction Fuzzy Hash: 5B218C76F006158FEB50CFB9E940AADB7F5EB48710F108126E906E7354E734D8418B90

Function 06F66DA4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003f4bf23d3bf35e5458a76a362ae9a82e1b324169a4a1ba8deaee12978664cd
Instruction ID: 59a914bc2e09cd11e33597d4a27ed5e061255410ee9e95f0fede4d773ed3876c
Opcode Fuzzy Hash: 003f4bf23d3bf35e5458a76a362ae9a82e1b324169a4a1ba8deaee12978664cd
Instruction Fuzzy Hash: A521DE30F100199BDF94DA6AE9506ADBBBBEB84320F208439F405DB340DB31EC428B91

Function 0152D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2913322514.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_152d000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efdcad27333997b77c0b68398c12495f0b69fa2c157b7cb9c686bf4c93d235be
Instruction ID: a50928a1860d28a008a42ca29a77585441a9350f573e29b58ef55b142385ee0a
Opcode Fuzzy Hash: efdcad27333997b77c0b68398c12495f0b69fa2c157b7cb9c686bf4c93d235be
Instruction Fuzzy Hash: 82213472504200DFCB11DF58D9C0B2ABBB5FB85314F20CA6DD9094F2A6D33AD847CA62

Function 06F66DAC Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c372a2b81a96112604630695bf93808e6d5e6b12c018ba6e48dba5083bb1720
Instruction ID: 6352150d3288eb4a4a59bbd15893b7e1fb259294e503988f87a2dbec93b8dbf9
Opcode Fuzzy Hash: 0c372a2b81a96112604630695bf93808e6d5e6b12c018ba6e48dba5083bb1720
Instruction Fuzzy Hash: D721AE30F101199BDF94DA6AE96069DBBBBEB84320F148475E405DB354DB35EC428B91

Function 06F66DB0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f1b6e285f2e22e8071c9cb4927695ecdeb9f91bbbda9452cf5bb6a3463a92b
Instruction ID: 9ff1cde6bcb6c4e6627a0af5fed3f3d5ea5ea0c7f0f686da257088e6979a1371
Opcode Fuzzy Hash: 27f1b6e285f2e22e8071c9cb4927695ecdeb9f91bbbda9452cf5bb6a3463a92b
Instruction Fuzzy Hash: 1A21C030F101099BDF94DA6AE95069DBBBBEB84320F108425E405DB350DB35EC418B90

Function 0152D006 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2913322514.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_152d000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0107ce6918fdaf112146683b4388979438d38f31890a2299b17a0785f8f1ea9c
Instruction ID: e3a1ed7112df0e9d4c01c74a3e1147803341e860dec0674be307e69d3c8a9c15
Opcode Fuzzy Hash: 0107ce6918fdaf112146683b4388979438d38f31890a2299b17a0785f8f1ea9c
Instruction Fuzzy Hash: 50216D7550D3C08FDB03CF64C990715BF71AB46214F29C5EBD8898F6A7C23A980ACB62

Function 06F63C98 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad0fd9d76e37ec635dd5c35b9620b32f954d924d92582473b5ce223b86f9d29
Instruction ID: d8faac0bdffe954d9718cf621dc2eafae2effa57ee25927c7c82807ada96318a
Opcode Fuzzy Hash: fad0fd9d76e37ec635dd5c35b9620b32f954d924d92582473b5ce223b86f9d29
Instruction Fuzzy Hash: 33118E32F101294BDF649A7AD9146AE72EAEBC8710F009439E406E7354EE24DC018BD1

Function 06F6EE11 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c182b1110747fedc49b86989c2b5c1be595b196f5aa052fe7f1ed41c5e14170f
Instruction ID: ec5b3faf11dfdd061197b091fc9ca738904a1d9ff2004c02273e8c10bdb718b7
Opcode Fuzzy Hash: c182b1110747fedc49b86989c2b5c1be595b196f5aa052fe7f1ed41c5e14170f
Instruction Fuzzy Hash: A0012F3AF082104FDB61A67EA454A3F3BD2DBC9720F00883AF04ACB352EA15DC028391

Function 06F642D8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d4c8ef493ea64a2be5e718aa5af9d714b1a205debe5ab9cbcffecda9269c25
Instruction ID: 3fd2e1c24b98c91acfa0dae622964056acd59b432207add7d1f08651e2bb6352
Opcode Fuzzy Hash: 63d4c8ef493ea64a2be5e718aa5af9d714b1a205debe5ab9cbcffecda9269c25
Instruction Fuzzy Hash: 3C01D431F041114FDB65AABE942672EB7D6EBCA620F20C83AF10ACB395ED65CC024381

Function 06F63950 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf3c70b57f285d1d3ddbf7cc90e3573c6eb07a30d3020b86d7664f30f018ab3
Instruction ID: 5ebd569987ae94f77e7b131ae72e3c24f00ea5570c8dc962894a8185bf92728e
Opcode Fuzzy Hash: 9bf3c70b57f285d1d3ddbf7cc90e3573c6eb07a30d3020b86d7664f30f018ab3
Instruction Fuzzy Hash: AF21CFB6D01219DFCB00CF9AD989ADEFBB5BB48314F10812AE918A7240C374A944CFA5

Function 06F63958 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4da3593cb4e410a868349fe416a504935d2e6bba945bfa2a09ca01b4a729be
Instruction ID: 075bf4939fec28b589f55a843b5256d8ffec8fa2de4a3bd3b2c5d4adec592b23
Opcode Fuzzy Hash: 1f4da3593cb4e410a868349fe416a504935d2e6bba945bfa2a09ca01b4a729be
Instruction Fuzzy Hash: AE11B0B5D01259AFCB00DF9AD885ADEFFB4FB49324F10812AE918A7340C375A954CFA5

Function 06F642E8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9eaa33036b067e60e52c9ab2858113e7e560ffc9a37e0e9d68fd12da437a5b4
Instruction ID: 9b124ba8a941874bb9f4eaeb4b7047aca5a08dd9f69141b9c9f02f08a2e60f1c
Opcode Fuzzy Hash: c9eaa33036b067e60e52c9ab2858113e7e560ffc9a37e0e9d68fd12da437a5b4
Instruction Fuzzy Hash: 4D018131F101114BDB64AABE9556B2FB6DAEBC9B24F20C839F10AC7394EE65DC024391

Function 06F642E5 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbdc508221241c6e26d0fb139b5d097d429b768d7cc46ef6cfd40171185adc28
Instruction ID: f2811958d7ab40cec23e88c5aae08e04e32d39576780b01907ef221f4f3d05e5
Opcode Fuzzy Hash: dbdc508221241c6e26d0fb139b5d097d429b768d7cc46ef6cfd40171185adc28
Instruction Fuzzy Hash: 5301D631F001114BDB609ABE955672EA3D7EBC9620F20C839F10AC7344ED65DC024381

Function 06F6EE20 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f889b3c6202ede2f6a065214bca8fb4350c5605c9db2ac977df9d255ccbaef
Instruction ID: 1f52b5d88d32564844329e312266bfd36207b32c3cf19cd7802c864b5d5f6678
Opcode Fuzzy Hash: e9f889b3c6202ede2f6a065214bca8fb4350c5605c9db2ac977df9d255ccbaef
Instruction Fuzzy Hash: 6901AF3AF140114FDBA59A7EA554B3E7BD6DBC9A20F108839F10ACB355EE26EC024385

Function 06F6A390 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394d86098016297863e479a5e2862914d37a721b6b38ef623e995ae1a75da959
Instruction ID: 6162650854551d111e1c2078f4237e284784429a7072efff8c03b532ed01bf1b
Opcode Fuzzy Hash: 394d86098016297863e479a5e2862914d37a721b6b38ef623e995ae1a75da959
Instruction Fuzzy Hash: 95014F30B101205FDB91DA7DD556B2E67D5E789764F108829F10AD7354EE26DC414781

Function 06F63C8C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68113015618d81c565e4cadb538c662443fdca2f4ab8ee7d76711360411ee86
Instruction ID: 8d014660ab5aa5bbd6bd92b5c39d135bd03affc14cf0aab2f171eb4998d54295
Opcode Fuzzy Hash: a68113015618d81c565e4cadb538c662443fdca2f4ab8ee7d76711360411ee86
Instruction Fuzzy Hash: 1E016D32F101294BEF949A6A99146BF76EFEBC8711F01543AE507E7284EE64CC0547D2

Function 06F6A398 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c90c1359f426381b6f28006c51a10533b93a960df60415853e9b4019e3af431
Instruction ID: f03e391b5f978b451dc1e6fb37825baf0e0ce570f992621bae317c45c25d033f
Opcode Fuzzy Hash: 1c90c1359f426381b6f28006c51a10533b93a960df60415853e9b4019e3af431
Instruction Fuzzy Hash: D7016D30B201205BDB60DA7DE966B2E77D5EBC9764F108839F10AD7354EE26EC424781

Function 06F63C94 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e254d4af30abfe76678b45ab3ef8684c0915d640911beef573d2d71a69bc2342
Instruction ID: 78abc11f7420b16cf029aba1dcca6d2f654d849ab81ece5c4781a5860432601c
Opcode Fuzzy Hash: e254d4af30abfe76678b45ab3ef8684c0915d640911beef573d2d71a69bc2342
Instruction Fuzzy Hash: 7C016D36F101254BDF949A6999142FE72AFAB88710F005536E506E7244EE24CC0647D1

Function 06F6A3A0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82c822961009984ee7835797f868d011991f26b19e4bb0d027abb8a42964d2a
Instruction ID: 348a383eabf6c733904cd76f0a04323e28150d0dd3fd50f566856d667261023e
Opcode Fuzzy Hash: c82c822961009984ee7835797f868d011991f26b19e4bb0d027abb8a42964d2a
Instruction Fuzzy Hash: 5F018C30B201205BDB60DA7DE965B2E77D9EBC9B64F108838F10AD7354EE26EC428781

Function 06F6A39D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63fe06ee4490b89d06e305f09d58dfb51c212ef9d55480cd443cd865ed99ecea
Instruction ID: 177a174f7ce7f5389c2a071d5ca557f73a979ab621d89f94f420fd55c7cb97de
Opcode Fuzzy Hash: 63fe06ee4490b89d06e305f09d58dfb51c212ef9d55480cd443cd865ed99ecea
Instruction Fuzzy Hash: BB018130F100104BDBA0DABDEA65B2E67D5EBC8724F108839F00AD7354EE26EC424780

Function 06F6C850 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e19c371ce2ef2031041816654145cd3471cc01f749424efc66f85da2c615d43
Instruction ID: 4763eb03449f8ddb006187bcd22711c1feb017e73c6c5f5d53cfcbade64f1e5b
Opcode Fuzzy Hash: 8e19c371ce2ef2031041816654145cd3471cc01f749424efc66f85da2c615d43
Instruction Fuzzy Hash: 2201F432F102249BCB649A6AF840A9EB7B9F784320F408439F941EB380DB32AC0487C0

Function 06F66511 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfbd691c5c70d7b192bde40dae9bac995c3d43821376c98d7440b550c1e36a4
Instruction ID: 0b59e21378353ec94f9eecab803aa07a07cc849f4b5424663ec2607fadb14a62
Opcode Fuzzy Hash: 8bfbd691c5c70d7b192bde40dae9bac995c3d43821376c98d7440b550c1e36a4
Instruction Fuzzy Hash: 50E08672E15108ABEF90DEB5DE4675E7B7DD702308F2084A6E405DB246E677CE028752

Function 06F66520 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94ad7eefe596bf28aa8267fd218daa69c805cffb676c170ff98b4d6ac38a593
Instruction ID: db46dc4b783d08206b97eeda5298ff39ea4bb49a59732e48a93ad9eea28b9739
Opcode Fuzzy Hash: c94ad7eefe596bf28aa8267fd218daa69c805cffb676c170ff98b4d6ac38a593
Instruction Fuzzy Hash: 50E0C272E10108ABDF90DEBACE4675E77ACD701208F2084A4E408D7202E273CE028741

Non-executed Functions

Function 06F67738 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$kq, xrefs: 06F67CDE
$kq, xrefs: 06F67C35
$kq, xrefs: 06F6786C
$kq, xrefs: 06F67C29
$kq, xrefs: 06F67CEA
$kq, xrefs: 06F67CC8
$kq, xrefs: 06F6789D
$kq, xrefs: 06F67878
$kq, xrefs: 06F678A9
$kq, xrefs: 06F67CD4

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1324371161
Opcode ID: a1d59f4c4cccccb946e969040b94431fe3b6638ff9b8d9e6234e8ef0aca47384
Instruction ID: b387954a4556f51ebf1351a02fe8ab905ac2e21318a802b00cee0233e4b9b277
Opcode Fuzzy Hash: a1d59f4c4cccccb946e969040b94431fe3b6638ff9b8d9e6234e8ef0aca47384
Instruction Fuzzy Hash: C3121E30E002198FDB64EF65C954AAEB7B6BF88304F248569E409AB364DB34DD85CF90

Function 06F6A9C0 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$kq, xrefs: 06F6AB48
$kq, xrefs: 06F6AB72
$kq, xrefs: 06F6AAC2
$kq, xrefs: 06F6AAB6
$kq, xrefs: 06F6AB1D
$kq, xrefs: 06F6AB3C
$kq, xrefs: 06F6AB7E
$kq, xrefs: 06F6AB11

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: 73d053446d84ed6886f86e1d26a9e098803a152e12561cb0221a31d0b7b0784a
Instruction ID: 5093f051b67a7a64113e7e6628129491358e04351598c535be12d12e119f269e
Opcode Fuzzy Hash: 73d053446d84ed6886f86e1d26a9e098803a152e12561cb0221a31d0b7b0784a
Instruction Fuzzy Hash: 6C915F30E10209DFDB68DF6ADA5476EB7B6FF84304F248529E402A7294DB79DC85CB90

Function 06F67138 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$kq, xrefs: 06F675D4
$kq, xrefs: 06F6764C
$kq, xrefs: 06F67474
$kq, xrefs: 06F67480
$kq, xrefs: 06F67640
$kq, xrefs: 06F6741A

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: b783d38a9e71539f7b57b250734d71811881a8357253cc2d1f63da84f1b5279e
Instruction ID: c972c6fb4e728fe376a2ed1b0e84f44793b747a93b6490e5fae081619b87635f
Opcode Fuzzy Hash: b783d38a9e71539f7b57b250734d71811881a8357253cc2d1f63da84f1b5279e
Instruction Fuzzy Hash: C4F17430B00205CFDB55EF69D554A6EB7B6FF89304F248569E4059B3A8DB39EC82CB50

Function 06F68468 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$kq, xrefs: 06F68733
$kq, xrefs: 06F686CE
$kq, xrefs: 06F68727
$kq, xrefs: 06F686C2

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 7265d2c9c28777e827cdd39952059701ebedb3b2a83cf1a2757ace01385928f5
Instruction ID: dcccab48388bb59e58098a12b2c81c7d7d915d77702f62bfe0b5d8112890e6e6
Opcode Fuzzy Hash: 7265d2c9c28777e827cdd39952059701ebedb3b2a83cf1a2757ace01385928f5
Instruction Fuzzy Hash: B8B15930E002098FDB65EF69C5506AEB7B6FF88350F24852DE4169B3A5DB75DC82CB90

Function 06F6AD48 Relevance: 5.2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

Strings

$kq, xrefs: 06F6AE79
$kq, xrefs: 06F6AEFB
$kq, xrefs: 06F6AECC
$kq, xrefs: 06F6AF24

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 02caa5ac6778a73eba11a73bbf6540baa3f0d25228d2554421e13dbf5ac4b243
Instruction ID: e1fc23082eb97fd364cb66a99fe15b8600e4d3cde695962faa607759dcdc7f96
Opcode Fuzzy Hash: 02caa5ac6778a73eba11a73bbf6540baa3f0d25228d2554421e13dbf5ac4b243
Instruction Fuzzy Hash: 5851C130F102058FCF65DB6AD98066EB7B6EF89310F248569E805EB391DB35EC41CB91

Function 06F68880 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRkq, xrefs: 06F68973
$kq, xrefs: 06F6890B
$kq, xrefs: 06F688FF
LRkq, xrefs: 06F689C2

Memory Dump Source

Source File: 00000002.00000002.2918643586.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_LisectAVT_2403002A_124.jbxd

Similarity

API ID:
String ID: LRkq$LRkq$$kq$$kq
API String ID: 0-2392252538
Opcode ID: f9b0ed2b4cd1e7dfad922852dba9e1d19ad36a8cddef62c18ce3310e48fa26ae
Instruction ID: c0da5c1d4006755aa24fca35ca1a84bfc9796f42ce6b925a013f86083eebecd9
Opcode Fuzzy Hash: f9b0ed2b4cd1e7dfad922852dba9e1d19ad36a8cddef62c18ce3310e48fa26ae
Instruction Fuzzy Hash: 4051C130B002029FDB58DF29D950A6AB7F6FF88354F14856DE4169B3A9DB35EC40CBA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_124.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_124.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
LisectAVT_2403002A_124.exe

Function 070A4C6D Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Function 070A4C78 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 026FADE8 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 026F590C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 026F44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 04D54040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 070A49E9 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre