Edit tour

Windows Analysis Report
ewdWlNc8TL.exe

Overview

General Information

Sample name:	ewdWlNc8TL.exe renamed because original name is a hash value
Original sample name:	6c2830c79d0a840f479ad635e3d57883.exe
Analysis ID:	1482762
MD5:	6c2830c79d0a840f479ad635e3d57883
SHA1:	dc4073381a79705a4df53048cad7b44679623835
SHA256:	a5f35b4f8933e0106c7743eaadbd3b883f61552add7ff17aca237450b3aa4168
Tags:	32exeTofseetrojan
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

ewdWlNc8TL.exe (PID: 3664 cmdline: "C:\Users\user\Desktop\ewdWlNc8TL.exe" MD5: 6C2830C79D0A840F479AD635E3D57883)

cmd.exe (PID: 6808 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rpfcsqnj\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2304 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ybuffopp.exe" C:\Windows\SysWOW64\rpfcsqnj\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2504 cmdline: "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4048 cmdline: "C:\Windows\System32\sc.exe" description rpfcsqnj "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 1868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6996 cmdline: "C:\Windows\System32\sc.exe" start rpfcsqnj MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5328 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7256 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 652 MD5: C31336C1EFC2CCB44B4326EA793040F2)

ybuffopp.exe (PID: 4048 cmdline: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d"C:\Users\user\Desktop\ewdWlNc8TL.exe" MD5: E4141310CE16DAF84C1718D66EAE2E57)

svchost.exe (PID: 7276 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 7316 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 540 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 6248 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7220 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3664 -ip 3664 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7284 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4048 -ip 4048 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.1760365617.000000000264D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4e6b:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1773773019.00000000025D9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4b13:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: ewdWlNc8TL.exe PID: 3664	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: ybuffopp.exe PID: 4048	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 7276	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.ewdWlNc8TL.exe.25e0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.ewdWlNc8TL.exe.25e0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.2.ybuffopp.exe.2c60000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.ybuffopp.exe.2c60000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.ybuffopp.exe.2c60000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.ybuffopp.exe.2c60000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.ybuffopp.exe.2c60000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.ybuffopp.exe.2c60000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.ewdWlNc8TL.exe.2600000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.ewdWlNc8TL.exe.2600000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.ewdWlNc8TL.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.ewdWlNc8TL.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.ewdWlNc8TL.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.ybuffopp.exe.2550e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.ybuffopp.exe.2550e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.3.ybuffopp.exe.2c60000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.ybuffopp.exe.2c60000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.ewdWlNc8TL.exe.25e0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.ewdWlNc8TL.exe.25e0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.ewdWlNc8TL.exe.25e0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.3.ybuffopp.exe.2c60000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.3.ybuffopp.exe.2c60000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.ybuffopp.exe.2c60000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.ybuffopp.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.ybuffopp.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.ybuffopp.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
17.2.svchost.exe.2f80000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
17.2.svchost.exe.2f80000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
17.2.svchost.exe.2f80000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.ewdWlNc8TL.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.ewdWlNc8TL.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.ewdWlNc8TL.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
17.2.svchost.exe.2f80000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
17.2.svchost.exe.2f80000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
17.2.svchost.exe.2f80000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.ybuffopp.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.ybuffopp.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.ybuffopp.exe.2550e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.ybuffopp.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.ybuffopp.exe.2550e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.ybuffopp.exe.2550e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d"C:\Users\user\Desktop\ewdWlNc8TL.exe", ParentImage: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, ParentProcessId: 4048, ParentProcessName: ybuffopp.exe, ProcessCommandLine: svchost.exe, ProcessId: 7276, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\ewdWlNc8TL.exe", ParentImage: C:\Users\user\Desktop\ewdWlNc8TL.exe, ParentProcessId: 3664, ParentProcessName: ewdWlNc8TL.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2504, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.8.49, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 7276, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d"C:\Users\user\Desktop\ewdWlNc8TL.exe", ParentImage: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, ParentProcessId: 4048, ParentProcessName: ybuffopp.exe, ProcessCommandLine: svchost.exe, ProcessId: 7276, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 7276, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\rpfcsqnj

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\ewdWlNc8TL.exe", ParentImage: C:\Users\user\Desktop\ewdWlNc8TL.exe, ParentProcessId: 3664, ParentProcessName: ewdWlNc8TL.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2504, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 6248, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T04:12:47.020064+0200
SID:	2022930
Source Port:	443
Destination Port:	61235
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T04:12:18.258834+0200
SID:	2022930
Source Port:	443
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: vanaheim.cn:443

Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for domain / URL

Source: vanaheim.cn	Virustotal: Detection: 17%	Perma Link
Source: vanaheim.cn:443	Virustotal: Detection: 7%	Perma Link
Source: jotunheim.name:443	Virustotal: Detection: 12%	Perma Link

Multi AV Scanner detection for submitted file

Source: ewdWlNc8TL.exe	ReversingLabs: Detection: 91%
Source: ewdWlNc8TL.exe	Virustotal: Detection: 74%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ybuffopp.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ewdWlNc8TL.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Unpacked PE file: 0.2.ewdWlNc8TL.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Unpacked PE file: 11.2.ybuffopp.exe.400000.0.unpack

Source: ewdWlNc8TL.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\rpfcsqnj

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 74.125.71.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.8.49 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.226.112.95 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.74 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.8.49 52.101.8.49
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 67.195.204.74 67.195.204.74

Source: Joe Sandbox View	ASN Name: RETN-ASEU RETN-ASEU
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU
Source: Joe Sandbox View	ASN Name: YAHOO-3US YAHOO-3US

Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 52.101.8.49:25
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 67.195.204.74:25
Source: global traffic	TCP traffic: 192.168.2.4:61236 -> 74.125.71.27:25
Source: global traffic	TCP traffic: 192.168.2.4:61238 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta6.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61239
Source: unknown	Network traffic detected: HTTP traffic on port 61237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61239 -> 443

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 11.2.ybuffopp.exe.2c60000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.2c60000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ewdWlNc8TL.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ewdWlNc8TL.exe.25e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.ybuffopp.exe.2c60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2f80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ewdWlNc8TL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.2550e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ewdWlNc8TL.exe PID: 3664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ybuffopp.exe PID: 4048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7276, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.ewdWlNc8TL.exe.25e0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.ewdWlNc8TL.exe.25e0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.ybuffopp.exe.2c60000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.ybuffopp.exe.2c60000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.ybuffopp.exe.2c60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.ybuffopp.exe.2c60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.ewdWlNc8TL.exe.2600000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.ewdWlNc8TL.exe.2600000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.ewdWlNc8TL.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.ewdWlNc8TL.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.ybuffopp.exe.2550e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.ybuffopp.exe.2550e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.ybuffopp.exe.2c60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.ybuffopp.exe.2c60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.ewdWlNc8TL.exe.25e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.ewdWlNc8TL.exe.25e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.ybuffopp.exe.2c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.ybuffopp.exe.2c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.ybuffopp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.ybuffopp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 17.2.svchost.exe.2f80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 17.2.svchost.exe.2f80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.ewdWlNc8TL.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.ewdWlNc8TL.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 17.2.svchost.exe.2f80000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 17.2.svchost.exe.2f80000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.ybuffopp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.ybuffopp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.ybuffopp.exe.2550e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.ybuffopp.exe.2550e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.1760365617.000000000264D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1773773019.00000000025D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\rpfcsqnj\

Jump to behavior

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Code function: 11_2_0040C913	11_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02F8C913	17_2_02F8C913

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: String function: 025E27AB appears 35 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3664 -ip 3664

Source: ewdWlNc8TL.exe, 00000000.00000002.1759735917.0000000002452000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOdilesigo6 vs ewdWlNc8TL.exe
Source: ewdWlNc8TL.exe, 00000000.00000002.1760384734.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesOdilesigo6 vs ewdWlNc8TL.exe
Source: ewdWlNc8TL.exe	Binary or memory string: OriginalFilenamesOdilesigo6 vs ewdWlNc8TL.exe

Source: ewdWlNc8TL.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.ewdWlNc8TL.exe.25e0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.ewdWlNc8TL.exe.25e0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.ybuffopp.exe.2c60000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.ybuffopp.exe.2c60000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.ybuffopp.exe.2c60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.ybuffopp.exe.2c60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.ewdWlNc8TL.exe.2600000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.ewdWlNc8TL.exe.2600000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.ewdWlNc8TL.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.ewdWlNc8TL.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.ybuffopp.exe.2550e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.ybuffopp.exe.2550e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.ybuffopp.exe.2c60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.ybuffopp.exe.2c60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.ewdWlNc8TL.exe.25e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.ewdWlNc8TL.exe.25e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.ybuffopp.exe.2c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.ybuffopp.exe.2c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.ybuffopp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.ybuffopp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 17.2.svchost.exe.2f80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 17.2.svchost.exe.2f80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.ewdWlNc8TL.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.ewdWlNc8TL.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 17.2.svchost.exe.2f80000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 17.2.svchost.exe.2f80000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.ybuffopp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.ybuffopp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.ybuffopp.exe.2550e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.ybuffopp.exe.2550e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.1760365617.000000000264D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1773773019.00000000025D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.evad.winEXE@31/3@9/5

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_02651E99 CreateToolhelp32Snapshot,Module32First,

0_2_02651E99

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02F89A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	17_2_02F89A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5180:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7220:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7108:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7284:64:WilError_03

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

File created: C:\Users\user\AppData\Local\Temp\ybuffopp.exe

Jump to behavior

Source: ewdWlNc8TL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ewdWlNc8TL.exe	ReversingLabs: Detection: 91%
Source: ewdWlNc8TL.exe	Virustotal: Detection: 74%

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

File read: C:\Users\user\Desktop\ewdWlNc8TL.exe

Jump to behavior

Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_11-14875

Source: unknown	Process created: C:\Users\user\Desktop\ewdWlNc8TL.exe "C:\Users\user\Desktop\ewdWlNc8TL.exe"
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rpfcsqnj\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ybuffopp.exe" C:\Windows\SysWOW64\rpfcsqnj\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description rpfcsqnj "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start rpfcsqnj
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d"C:\Users\user\Desktop\ewdWlNc8TL.exe"
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3664 -ip 3664
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 652
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4048 -ip 4048
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 540
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rpfcsqnj\	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ybuffopp.exe" C:\Windows\SysWOW64\rpfcsqnj\	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description rpfcsqnj "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start rpfcsqnj	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3664 -ip 3664	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 652	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4048 -ip 4048	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 540	Jump to behavior

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: ewdWlNc8TL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Unpacked PE file: 0.2.ewdWlNc8TL.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Unpacked PE file: 11.2.ybuffopp.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Unpacked PE file: 0.2.ewdWlNc8TL.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Unpacked PE file: 11.2.ybuffopp.exe.400000.0.unpack

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: 0_2_02655181 push 0000002Bh; iretd		0_2_02655187
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Code function: 11_2_025E0E29 push 0000002Bh; iretd		11_2_025E0E2F

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe (copy)			Jump to dropped file
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	File created: C:\Users\user\AppData\Local\Temp\ybuffopp.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rpfcsqnj

Jump to behavior

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\ewdwlnc8tl.exe

Jump to behavior

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

17_2_02F8199C

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15851
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_11-15266
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_17-6489

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_17-6158

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_17-7344
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-15908
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_11-15256

Source: C:\Windows\SysWOW64\svchost.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_17-7459

Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_11-14890
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_17-6187
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-14727

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	API coverage: 5.4 %
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	API coverage: 3.9 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 7312	Thread sleep count: 33 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7312	Thread sleep time: -33000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000011.00000002.2948546824.0000000003400000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"2

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	API call chain: ExitProcess graph end node			graph_0-15156
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node			graph_17-6191

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe

Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep

graph_17-7683

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: 0_2_025E092B mov eax, dword ptr fs:[00000030h]	0_2_025E092B
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: 0_2_025E0D90 mov eax, dword ptr fs:[00000030h]	0_2_025E0D90
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: 0_2_02651776 push dword ptr fs:[00000030h]	0_2_02651776
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Code function: 11_2_0255092B mov eax, dword ptr fs:[00000030h]	11_2_0255092B
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Code function: 11_2_02550D90 mov eax, dword ptr fs:[00000030h]	11_2_02550D90
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Code function: 11_2_025DD41E push dword ptr fs:[00000030h]	11_2_025DD41E

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02F89A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	17_2_02F89A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 74.125.71.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.8.49 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.226.112.95 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.74 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2F80000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2F80000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2F80000			Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 31F4008			Jump to behavior

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rpfcsqnj\	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ybuffopp.exe" C:\Windows\SysWOW64\rpfcsqnj\	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description rpfcsqnj "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start rpfcsqnj	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3664 -ip 3664	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 652	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4048 -ip 4048	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 540	Jump to behavior

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

0_2_00407809

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 11.2.ybuffopp.exe.2c60000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.2c60000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ewdWlNc8TL.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ewdWlNc8TL.exe.25e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.ybuffopp.exe.2c60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2f80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ewdWlNc8TL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.2550e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ewdWlNc8TL.exe PID: 3664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ybuffopp.exe PID: 4048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7276, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 11.2.ybuffopp.exe.2c60000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.2c60000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ewdWlNc8TL.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ewdWlNc8TL.exe.25e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.ybuffopp.exe.2c60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.ewdWlNc8TL.exe.2600000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2f80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ewdWlNc8TL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.2f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ybuffopp.exe.2550e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ewdWlNc8TL.exe PID: 3664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ybuffopp.exe PID: 4048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7276, type: MEMORYSTR

Source: C:\Users\user\Desktop\ewdWlNc8TL.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe	Code function: 11_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	11_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 17_2_02F888B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	17_2_02F888B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	2 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ewdWlNc8TL.exe	92%	ReversingLabs	Win32.Trojan.StealC
ewdWlNc8TL.exe	75%	Virustotal		Browse
ewdWlNc8TL.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\ybuffopp.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
mta6.am0.yahoodns.net	1%	Virustotal	Browse
mxs.mail.ru	0%	Virustotal	Browse
microsoft-com.mail.protection.outlook.com	0%	Virustotal	Browse
vanaheim.cn	17%	Virustotal	Browse
google.com	0%	Virustotal	Browse
smtp.google.com	0%	Virustotal	Browse
yahoo.com	0%	Virustotal	Browse
mail.ru	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
vanaheim.cn:443	100%	Avira URL Cloud	phishing
jotunheim.name:443	0%	Avira URL Cloud	safe
vanaheim.cn:443	8%	Virustotal		Browse
jotunheim.name:443	13%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mta6.am0.yahoodns.net	67.195.204.74	true	true	1%, Virustotal, Browse	unknown
mxs.mail.ru	217.69.139.150	true	true	0%, Virustotal, Browse	unknown
microsoft-com.mail.protection.outlook.com	52.101.8.49	true	true	0%, Virustotal, Browse	unknown
vanaheim.cn	213.226.112.95	true	true	17%, Virustotal, Browse	unknown
smtp.google.com	74.125.71.27	true	false	0%, Virustotal, Browse	unknown
google.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
yahoo.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
mail.ru	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	8%, Virustotal, Browse Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.71.27	smtp.google.com	United States	15169	GOOGLEUS	false
213.226.112.95	vanaheim.cn	Russian Federation	9002	RETN-ASEU	true
52.101.8.49	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
67.195.204.74	mta6.am0.yahoodns.net	United States	26101	YAHOO-3US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482762
Start date and time:	2024-07-26 04:11:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ewdWlNc8TL.exe renamed because original name is a hash value
Original Sample Name:	6c2830c79d0a840f479ad635e3d57883.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@31/3@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 61 Number of non-executed functions: 255
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.76.201.171, 20.70.246.20, 20.112.250.133, 20.231.239.246, 20.236.44.162
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:12:48	API Interceptor	7x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
213.226.112.95	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
52.101.8.49	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse
	lhs31fcc2k0lmr.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.11678.1633.exe	Get hash	malicious	Tofsee	Browse
217.69.139.150	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse
67.195.204.74	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	message.elm.exe	Get hash	malicious	Unknown	Browse
	message.txt.exe	Get hash	malicious	Unknown	Browse
	test.dat.exe	Get hash	malicious	Unknown	Browse
	Update-KB2984-x86.exe	Get hash	malicious	Unknown	Browse
	64434c8c20fe4b64041795ac2a1472662fa5d33fa0cbb.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta6.am0.yahoodns.net	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	98.136.96.75
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.72
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	67.195.228.109
	webcam.txt.com.exe	Get hash	malicious	Unknown	Browse	67.195.204.73
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.106
microsoft-com.mail.protection.outlook.com	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	setup.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	bill.txt.exe	Get hash	malicious	Unknown	Browse	104.47.54.36
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
vanaheim.cn	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	setup.exe	Get hash	malicious	Tofsee	Browse	185.218.0.41
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	62.76.228.127
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	62.76.228.127
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	141.8.199.94
mxs.mail.ru	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	setup.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	94.100.180.31
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	yq5xNPpWCT.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	94.100.180.31
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RETN-ASEU	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	139.45.197.236
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	139.45.197.236
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	https://ky.codzika.xyz/pubg/	Get hash	malicious	Unknown	Browse	139.45.197.250
	https://plcr.com.ng/atm.php?user=21003&ref=21003	Get hash	malicious	Unknown	Browse	139.45.197.237
	http://becast.onionlive.workers.dev	Get hash	malicious	Unknown	Browse	139.45.197.236
	http://thampolsi.com	Get hash	malicious	Unknown	Browse	139.45.197.244
	http://webnovelpub.pro/	Get hash	malicious	Unknown	Browse	139.45.195.254
	vk2wTOx91s.exe	Get hash	malicious	CopperShrimp, Cryptbot	Browse	176.113.81.61
	https://thuthoock.net/	Get hash	malicious	Unknown	Browse	139.45.197.245
MAILRU-ASMailRuRU	7Y18r(123).exe	Get hash	malicious	Unknown	Browse	94.100.180.106
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	setup.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SecuriteInfo.com.W32.Kryptik.CI.tr.21358.1519.exe	Get hash	malicious	Unknown	Browse	5.61.236.163
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	79.137.247.12
	SIP.03746.XSLSX.exe	Get hash	malicious	Unknown	Browse	217.69.139.160
	1PDF.FaturaDetay_202407.exe	Get hash	malicious	Unknown	Browse	217.69.139.160
	PDF.FaturaDetay_202407.exe	Get hash	malicious	Unknown	Browse	94.100.180.160
	SIP.03746.XSLSX.exe	Get hash	malicious	Unknown	Browse	94.100.180.160
	1PDF.FaturaDetay_202407.exe	Get hash	malicious	Unknown	Browse	217.69.139.160
YAHOO-3US	arm7.elf	Get hash	malicious	Mirai	Browse	98.139.166.43
	https://www.ima-india.com/index.php	Get hash	malicious	Unknown	Browse	74.6.138.67
	https://www.ima-india.com/index.php	Get hash	malicious	Unknown	Browse	74.6.138.67
	https://www.ima-india.com/index.php?option=com_content&view=article&id=1092&Itemid=483	Get hash	malicious	Unknown	Browse	74.6.138.65
	D8OieODwpn.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	72.30.110.165
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	67.195.204.77
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	67.195.204.74
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	67.195.204.72
	HTUyCRuDev.elf	Get hash	malicious	Unknown	Browse	98.139.142.32
	https://yellatism.com/click.php?key=2240o76mk7oyoycyr074&cid=cphbldi9sch0sh7da130&zone=2353135-2517555085-3576986712&campaign=395161020&type=Push&age=11&creative_id=547520&campaign_id=108855&site_id=11517&placement_id=43113822&preset_id=500	Get hash	malicious	Unknown	Browse	74.6.143.26
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://odc.officeapps.live.com.mcas.ms/odc/v2.1/hrd?rs=en-US&Ver=16&app=111&p=6&hm=0&fpEnabled=1&McasTsid=REDACTED	Get hash	malicious	Unknown	Browse	52.109.28.48
	file.exe	Get hash	malicious	Babadeda	Browse	23.101.168.44
	file.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56
	My Info Tech Partner Executed Agreement Docs#071999(Revised).pdf	Get hash	malicious	HTMLPhisher	Browse	40.126.32.134
	TBw6qwEBHZ.exe	Get hash	malicious	BlackMoon, Neshta, XRed	Browse	13.107.246.60
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse	20.189.173.22
	file.exe	Get hash	malicious	Babadeda	Browse	204.79.197.237
	EB34B4827C25A458359FE317D886E56C7B3C75A140DCD57D604FC093A9AA2B2C.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Endermanch@DeriaLock.exe	Get hash	malicious	DeriaLock	Browse	13.107.246.60
	Endermanch@InfinityCrypt.exe	Get hash	malicious	InfinityLock	Browse	13.107.246.60

Process:	C:\Users\user\Desktop\ewdWlNc8TL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11662848
Entropy (8bit):	4.152879666199878
Encrypted:	false
SSDEEP:	98304:Nfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff:
MD5:	E4141310CE16DAF84C1718D66EAE2E57
SHA1:	1BB39DEF90C68EC9AA3D33D6844B7226655331D3
SHA-256:	490D441334643A6658C385B15E41CFDB94A321903B2E9D3EDF59D1701EA60484
SHA-512:	1976BC25AE7B2D80EDD12943577F54EBDF3005032C8243C445936915AFE1E349C865C37503F1B6FC5A170551D1520A024399572EF1DC75049518543F4E4F18F2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G!GW&O.W&O.W&O.8P..D&O.8P..3&O.8P..H&O.^^..P&O.W&N.&&O.8P..V&O.8P..V&O.8P..V&O.RichW&O.........PE..L......e.....................D.......1............@..................................K..........................................P.... .................................................................@............................................text...C........................... ..`.rdata.. 6.......8..................@..@.data...............................@....rsrc....... ...H..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11662848
Entropy (8bit):	4.152879666199878
Encrypted:	false
SSDEEP:	98304:Nfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff:
MD5:	E4141310CE16DAF84C1718D66EAE2E57
SHA1:	1BB39DEF90C68EC9AA3D33D6844B7226655331D3
SHA-256:	490D441334643A6658C385B15E41CFDB94A321903B2E9D3EDF59D1701EA60484
SHA-512:	1976BC25AE7B2D80EDD12943577F54EBDF3005032C8243C445936915AFE1E349C865C37503F1B6FC5A170551D1520A024399572EF1DC75049518543F4E4F18F2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G!GW&O.W&O.W&O.8P..D&O.8P..3&O.8P..H&O.^^..P&O.W&N.&&O.8P..V&O.8P..V&O.8P..V&O.RichW&O.........PE..L......e.....................D.......1............@..................................K..........................................P.... .................................................................@............................................text...C........................... ..`.rdata.. 6.......8..................@..@.data...............................@....rsrc....... ...H..................@..@................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.2465418897075
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ewdWlNc8TL.exe
File size:	274'944 bytes
MD5:	6c2830c79d0a840f479ad635e3d57883
SHA1:	dc4073381a79705a4df53048cad7b44679623835
SHA256:	a5f35b4f8933e0106c7743eaadbd3b883f61552add7ff17aca237450b3aa4168
SHA512:	0a17899c829495dddf3d08a832c7e2b4747ab9665089a9d6b8d5bb625e4851e885800cb242241740853f9e5ad30449f710edd231865c49d464a7aa3084aedc91
SSDEEP:	3072:66kSFokrBF+7cvxpl1oZkNYe/v4IMbGhULweRQvybL2RxTTu:jzfrK+Dl1ou2HtmaLgxTT
TLSH:	7244CF1176A6D472D1B2463058B4C6F52AFA7C23DAB9815B3B483F3F3D322925B68353
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G!GW&O.W&O.W&O.8P..D&O.8P..3&O.8P..H&O.^^..P&O.W&N.&&O.8P..V&O.8P..V&O.8P..V&O.RichW&O.........PE..L......e...................

File Icon


Icon Hash:	63396de961436e0f

Static PE Info

General

Entrypoint:	0x403198
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x658A97A9 [Tue Dec 26 09:06:49 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3ee3964629fff7decd6eee12d8b20149

Entrypoint Preview

Instruction
call 00007F8470F76BB7h
jmp 00007F8470F7262Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0042D274h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F8470F727AEh
test byte ptr [eax], 00000008h
je 00007F8470F727A9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0042D0CCh]
leave
retn 0008h
push edi
mov eax, esi
and eax, 0Fh
test eax, eax
jne 00007F8470F72867h
mov edx, ecx
and ecx, 7Fh
shr edx, 07h
je 00007F8470F72807h
jmp 00007F8470F727A8h
lea ebx, dword ptr [ebx+00000000h]
movdqa xmm0, dqword ptr [esi]
movdqa xmm1, dqword ptr [esi+10h]
movdqa xmm2, dqword ptr [esi+20h]
movdqa xmm3, dqword ptr [esi+30h]
movdqa dqword ptr [edi], xmm0
movdqa dqword ptr [edi+10h], xmm1
movdqa dqword ptr [edi+20h], xmm2
movdqa dqword ptr [edi+30h], xmm3
movdqa xmm4, dqword ptr [esi+40h]
movdqa xmm5, dqword ptr [esi+50h]
movdqa xmm6, dqword ptr [esi+60h]
movdqa xmm7, dqword ptr [esi+70h]
movdqa dqword ptr [edi+40h], xmm4
movdqa dqword ptr [edi+50h], xmm5
movdqa dqword ptr [edi+60h], xmm6
movdqa dqword ptr [edi+70h], xmm7
lea esi, dword ptr [esi+00000080h]

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2fc84	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2052000	0x82e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2fcd4	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2f300	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d000	0x1a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b743	0x2b800	1e404cc212a213d92766f2fa9161b0a6	False	0.6290802352729885	data	6.279343610638027	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0x3620	0x3800	781065e0fe97db03e9c6cf3f905c4ccf	False	0.3412388392857143	data	4.8317589044540075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x31000	0x2020bf0	0xba00	ea770be69984578b59c7da74d62d8f8a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2052000	0x82e8	0x8400	8e11723a15c44916521fb325791d1198	False	0.3206972064393939	data	4.107102812401712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x20555c8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x20556f8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x20557d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x2056678	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x2056f20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x20574b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x2058360	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x2058c08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x2052480	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5339861751152074
RT_ICON	0x2052480	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5339861751152074
RT_ICON	0x2052b48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.40860995850622406
RT_ICON	0x2052b48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.40860995850622406
RT_ICON	0x20550f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.450354609929078
RT_ICON	0x20550f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.450354609929078
RT_STRING	0x20593d0	0x452	data	Tamil	India	0.45479204339963836
RT_STRING	0x20593d0	0x452	data	Tamil	Sri Lanka	0.45479204339963836
RT_STRING	0x2059828	0x28e	data	Tamil	India	0.481651376146789
RT_STRING	0x2059828	0x28e	data	Tamil	Sri Lanka	0.481651376146789
RT_STRING	0x2059ab8	0x82a	data	Tamil	India	0.41818181818181815
RT_STRING	0x2059ab8	0x82a	data	Tamil	Sri Lanka	0.41818181818181815
RT_ACCELERATOR	0x2055588	0x40	data	Tamil	India	0.875
RT_ACCELERATOR	0x2055588	0x40	data	Tamil	Sri Lanka	0.875
RT_GROUP_CURSOR	0x20557a8	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x2057488	0x30	data			0.9166666666666666
RT_GROUP_CURSOR	0x2059170	0x30	data			0.9375
RT_GROUP_ICON	0x2055558	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0x2055558	0x30	data	Tamil	Sri Lanka	0.9375
RT_VERSION	0x20591a0	0x22c	data			0.5233812949640287

Imports

DLL	Import
KERNEL32.dll	SetEndOfFile, LocalCompact, GlobalLock, CreateHardLinkA, GetModuleHandleW, CreateNamedPipeW, GetProcessHeap, GetConsoleCP, GlobalAlloc, GetSystemDirectoryW, LoadLibraryW, IsProcessInJob, AssignProcessToJobObject, CreateEventA, CreateJobObjectA, GetConsoleAliasesW, GetLastError, SetLastError, GetProcAddress, PeekConsoleInputW, EnumDateFormatsExA, VerLanguageNameW, IsBadHugeReadPtr, SetConsoleCtrlHandler, AddAtomW, HeapWalk, EnumResourceTypesW, SetEnvironmentVariableA, GetModuleFileNameA, GetOEMCP, EnumResourceNamesA, GetFileTime, FatalAppExitA, SetProcessShutdownParameters, SetFileShortNameA, GetDiskFreeSpaceExA, LCMapStringW, CreateFileW, CloseHandle, WriteConsoleW, FlushFileBuffers, HeapReAlloc, FindFirstVolumeMountPointW, CreateFileA, HeapFree, HeapAlloc, GetCommandLineA, HeapSetInformation, GetStartupInfoW, RaiseException, IsProcessorFeaturePresent, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, IsValidCodePage, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, DecodePointer, TlsFree, GetCurrentThreadId, HeapCreate, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, ExitProcess, WriteFile, GetModuleFileNameW, ReadFile, MultiByteToWideChar, SetFilePointer, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetStringTypeW, Sleep, GetConsoleMode, RtlUnwind, SetStdHandle, HeapSize
USER32.dll	CharUpperBuffW, GetMessageExtraInfo, DrawStateW, SetMenu, GetSysColorBrush, SetCaretPos, SetClipboardViewer
ADVAPI32.dll	RegSetValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T04:12:47.020064+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	61235	40.127.169.103	192.168.2.4
2024-07-26T04:12:18.258834+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49733	40.127.169.103	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 04:12:06.719734907 CEST	49731	25	192.168.2.4	52.101.8.49
Jul 26, 2024 04:12:07.713790894 CEST	49731	25	192.168.2.4	52.101.8.49
Jul 26, 2024 04:12:09.644850969 CEST	49732	443	192.168.2.4	213.226.112.95
Jul 26, 2024 04:12:09.644936085 CEST	443	49732	213.226.112.95	192.168.2.4
Jul 26, 2024 04:12:09.645230055 CEST	49732	443	192.168.2.4	213.226.112.95
Jul 26, 2024 04:12:09.729433060 CEST	49731	25	192.168.2.4	52.101.8.49
Jul 26, 2024 04:12:13.729377985 CEST	49731	25	192.168.2.4	52.101.8.49
Jul 26, 2024 04:12:21.729422092 CEST	49731	25	192.168.2.4	52.101.8.49
Jul 26, 2024 04:12:26.751518965 CEST	49739	25	192.168.2.4	67.195.204.74
Jul 26, 2024 04:12:27.760688066 CEST	49739	25	192.168.2.4	67.195.204.74
Jul 26, 2024 04:12:29.760658979 CEST	49739	25	192.168.2.4	67.195.204.74
Jul 26, 2024 04:12:33.760746002 CEST	49739	25	192.168.2.4	67.195.204.74
Jul 26, 2024 04:12:41.776364088 CEST	49739	25	192.168.2.4	67.195.204.74
Jul 26, 2024 04:12:46.777574062 CEST	61236	25	192.168.2.4	74.125.71.27
Jul 26, 2024 04:12:47.776376963 CEST	61236	25	192.168.2.4	74.125.71.27
Jul 26, 2024 04:12:49.651454926 CEST	49732	443	192.168.2.4	213.226.112.95
Jul 26, 2024 04:12:49.651556969 CEST	443	49732	213.226.112.95	192.168.2.4
Jul 26, 2024 04:12:49.651629925 CEST	49732	443	192.168.2.4	213.226.112.95
Jul 26, 2024 04:12:49.761895895 CEST	61237	443	192.168.2.4	213.226.112.95
Jul 26, 2024 04:12:49.761953115 CEST	443	61237	213.226.112.95	192.168.2.4
Jul 26, 2024 04:12:49.762166977 CEST	61237	443	192.168.2.4	213.226.112.95
Jul 26, 2024 04:12:49.776470900 CEST	61236	25	192.168.2.4	74.125.71.27
Jul 26, 2024 04:12:53.792233944 CEST	61236	25	192.168.2.4	74.125.71.27
Jul 26, 2024 04:13:01.807873011 CEST	61236	25	192.168.2.4	74.125.71.27
Jul 26, 2024 04:13:06.801518917 CEST	61238	25	192.168.2.4	217.69.139.150
Jul 26, 2024 04:13:07.807815075 CEST	61238	25	192.168.2.4	217.69.139.150
Jul 26, 2024 04:13:09.807828903 CEST	61238	25	192.168.2.4	217.69.139.150
Jul 26, 2024 04:13:13.807984114 CEST	61238	25	192.168.2.4	217.69.139.150
Jul 26, 2024 04:13:21.807888031 CEST	61238	25	192.168.2.4	217.69.139.150
Jul 26, 2024 04:13:29.761310101 CEST	61237	443	192.168.2.4	213.226.112.95
Jul 26, 2024 04:13:29.761441946 CEST	443	61237	213.226.112.95	192.168.2.4
Jul 26, 2024 04:13:29.761790037 CEST	61237	443	192.168.2.4	213.226.112.95
Jul 26, 2024 04:13:29.871499062 CEST	61239	443	192.168.2.4	213.226.112.95
Jul 26, 2024 04:13:29.871534109 CEST	443	61239	213.226.112.95	192.168.2.4
Jul 26, 2024 04:13:29.872221947 CEST	61239	443	192.168.2.4	213.226.112.95

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 04:12:06.664130926 CEST	51222	53	192.168.2.4	1.1.1.1
Jul 26, 2024 04:12:06.718054056 CEST	53	51222	1.1.1.1	192.168.2.4
Jul 26, 2024 04:12:09.636693001 CEST	50936	53	192.168.2.4	1.1.1.1
Jul 26, 2024 04:12:09.644001961 CEST	53	50936	1.1.1.1	192.168.2.4
Jul 26, 2024 04:12:26.730237961 CEST	58537	53	192.168.2.4	1.1.1.1
Jul 26, 2024 04:12:26.737260103 CEST	53	58537	1.1.1.1	192.168.2.4
Jul 26, 2024 04:12:26.738137960 CEST	57117	53	192.168.2.4	1.1.1.1
Jul 26, 2024 04:12:26.745398998 CEST	53	57117	1.1.1.1	192.168.2.4
Jul 26, 2024 04:12:45.066613913 CEST	53	51029	162.159.36.2	192.168.2.4
Jul 26, 2024 04:12:45.871397972 CEST	53	52198	1.1.1.1	192.168.2.4
Jul 26, 2024 04:12:46.761281013 CEST	57799	53	192.168.2.4	1.1.1.1
Jul 26, 2024 04:12:46.768919945 CEST	53	57799	1.1.1.1	192.168.2.4
Jul 26, 2024 04:12:46.769582033 CEST	53417	53	192.168.2.4	1.1.1.1
Jul 26, 2024 04:12:46.777045012 CEST	53	53417	1.1.1.1	192.168.2.4
Jul 26, 2024 04:13:06.781939983 CEST	57842	53	192.168.2.4	1.1.1.1
Jul 26, 2024 04:13:06.790203094 CEST	53	57842	1.1.1.1	192.168.2.4
Jul 26, 2024 04:13:06.791930914 CEST	63669	53	192.168.2.4	1.1.1.1
Jul 26, 2024 04:13:06.800410032 CEST	53	63669	1.1.1.1	192.168.2.4
Jul 26, 2024 04:14:04.722315073 CEST	60105	53	192.168.2.4	1.1.1.1
Jul 26, 2024 04:14:04.758263111 CEST	53	60105	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 04:12:06.664130926 CEST	192.168.2.4	1.1.1.1	0x15b1	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:09.636693001 CEST	192.168.2.4	1.1.1.1	0x8067	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:26.730237961 CEST	192.168.2.4	1.1.1.1	0x7172	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Jul 26, 2024 04:12:26.738137960 CEST	192.168.2.4	1.1.1.1	0xae87	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:46.761281013 CEST	192.168.2.4	1.1.1.1	0xc96f	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Jul 26, 2024 04:12:46.769582033 CEST	192.168.2.4	1.1.1.1	0xee64	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:13:06.781939983 CEST	192.168.2.4	1.1.1.1	0x9b06	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Jul 26, 2024 04:13:06.791930914 CEST	192.168.2.4	1.1.1.1	0x279d	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:14:04.722315073 CEST	192.168.2.4	1.1.1.1	0xc8da	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 04:12:06.718054056 CEST	1.1.1.1	192.168.2.4	0x15b1	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:06.718054056 CEST	1.1.1.1	192.168.2.4	0x15b1	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:06.718054056 CEST	1.1.1.1	192.168.2.4	0x15b1	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:06.718054056 CEST	1.1.1.1	192.168.2.4	0x15b1	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:09.644001961 CEST	1.1.1.1	192.168.2.4	0x8067	No error (0)	vanaheim.cn	213.226.112.95	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:26.737260103 CEST	1.1.1.1	192.168.2.4	0x7172	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Jul 26, 2024 04:12:26.737260103 CEST	1.1.1.1	192.168.2.4	0x7172	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Jul 26, 2024 04:12:26.737260103 CEST	1.1.1.1	192.168.2.4	0x7172	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Jul 26, 2024 04:12:26.745398998 CEST	1.1.1.1	192.168.2.4	0xae87	No error (0)	mta6.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:26.745398998 CEST	1.1.1.1	192.168.2.4	0xae87	No error (0)	mta6.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:26.745398998 CEST	1.1.1.1	192.168.2.4	0xae87	No error (0)	mta6.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:26.745398998 CEST	1.1.1.1	192.168.2.4	0xae87	No error (0)	mta6.am0.yahoodns.net	98.136.96.75	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:26.745398998 CEST	1.1.1.1	192.168.2.4	0xae87	No error (0)	mta6.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:26.745398998 CEST	1.1.1.1	192.168.2.4	0xae87	No error (0)	mta6.am0.yahoodns.net	98.136.96.74	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:26.745398998 CEST	1.1.1.1	192.168.2.4	0xae87	No error (0)	mta6.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:26.745398998 CEST	1.1.1.1	192.168.2.4	0xae87	No error (0)	mta6.am0.yahoodns.net	67.195.228.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:46.768919945 CEST	1.1.1.1	192.168.2.4	0xc96f	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Jul 26, 2024 04:12:46.777045012 CEST	1.1.1.1	192.168.2.4	0xee64	No error (0)	smtp.google.com	74.125.71.27	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:46.777045012 CEST	1.1.1.1	192.168.2.4	0xee64	No error (0)	smtp.google.com	74.125.71.26	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:46.777045012 CEST	1.1.1.1	192.168.2.4	0xee64	No error (0)	smtp.google.com	74.125.133.26	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:46.777045012 CEST	1.1.1.1	192.168.2.4	0xee64	No error (0)	smtp.google.com	64.233.166.27	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:12:46.777045012 CEST	1.1.1.1	192.168.2.4	0xee64	No error (0)	smtp.google.com	64.233.166.26	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:13:06.790203094 CEST	1.1.1.1	192.168.2.4	0x9b06	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Jul 26, 2024 04:13:06.800410032 CEST	1.1.1.1	192.168.2.4	0x279d	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:13:06.800410032 CEST	1.1.1.1	192.168.2.4	0x279d	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:14:04.758263111 CEST	1.1.1.1	192.168.2.4	0xc8da	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:14:04.758263111 CEST	1.1.1.1	192.168.2.4	0xc8da	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:14:04.758263111 CEST	1.1.1.1	192.168.2.4	0xc8da	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Jul 26, 2024 04:14:04.758263111 CEST	1.1.1.1	192.168.2.4	0xc8da	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	22:11:57
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\ewdWlNc8TL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ewdWlNc8TL.exe"
Imagebase:	0x400000
File size:	274'944 bytes
MD5 hash:	6C2830C79D0A840F479AD635E3D57883
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1760365617.000000000264D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.1720652652.0000000002600000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:12:01
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rpfcsqnj\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:12:01
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:12:01
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ybuffopp.exe" C:\Windows\SysWOW64\rpfcsqnj\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:12:01
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:12:02
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create rpfcsqnj binPath= "C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d\"C:\Users\user\Desktop\ewdWlNc8TL.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0x980000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:12:02
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:12:02
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description rpfcsqnj "wifi internet conection"
Imagebase:	0x980000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:12:02
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:12:03
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start rpfcsqnj
Imagebase:	0x980000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:12:03
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:12:03
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe /d"C:\Users\user\Desktop\ewdWlNc8TL.exe"
Imagebase:	0x400000
File size:	11'662'848 bytes
MD5 hash:	E4141310CE16DAF84C1718D66EAE2E57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000003.1770040637.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.1774025895.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.1773773019.00000000025D9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:12:03
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:12:03
Start date:	25/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	22:12:03
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:12:03
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3664 -ip 3664
Imagebase:	0x270000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:12:04
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 652
Imagebase:	0x270000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:12:05
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x9f0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	22:12:05
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4048 -ip 4048
Imagebase:	0x270000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:12:05
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 540
Imagebase:	0x270000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	25.6%
Total number of Nodes:	1548
Total number of Limit Nodes:	18

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

%X%08X, xrefs: 0040A0B0
D, xrefs: 00409F8E
", xrefs: 0040A189
", xrefs: 00409EDB
\, xrefs: 00409D0C
P, xrefs: 00409DAA
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 0040A078

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 1766690efc88ce29846324f8dfd8ebf0ff4b658a314e2c6797e2be59256e70c4
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 1766690efc88ce29846324f8dfd8ebf0ff4b658a314e2c6797e2be59256e70c4
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 97af48ab48525fb617f5abd17424ad614edf633f88179256e16c2771f2badf11
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: 97af48ab48525fb617f5abd17424ad614edf633f88179256e16c2771f2badf11
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 02651E99 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02651EC1
Module32First.KERNEL32(00000000,00000224), ref: 02651EE1

Memory Dump Source

Source File: 00000000.00000002.1760365617.000000000264D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0264D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_264d000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 04a35835b5f39a0bb073a89ee4899d88763a6d6ac9d54911b7ca01cdcd65ddf5
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: D0F096355007256BD7203BF9DC8CB6F76ECAF4A625F100668EA4B921C0DBB4E8454AA1

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: fb0f2a9e6fd52b701184d9b1120ae1b26139c4ce9695fa828964d471d7998326
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: fb0f2a9e6fd52b701184d9b1120ae1b26139c4ce9695fa828964d471d7998326
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 844d959b869107477598dc7fc3fd0898fc590bab3c8716b4da34f6361cc296a8
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 844d959b869107477598dc7fc3fd0898fc590bab3c8716b4da34f6361cc296a8
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 025E003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 025E024D

Strings

cess, xrefs: 025E018D
kernel32.dll, xrefs: 025E008F, 025E0095

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c97db3b646984794bd1160e20933eaed74d62d05f938e549ae04c2f16b3e5529
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 2C526974A01229DFDB64CF58C985BACBBB1BF09314F1480D9E54EAB391DB70AA85CF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 025E0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,025E0223,?,?), ref: 025E0E19
SetErrorMode.KERNELBASE(00000000,?,?,025E0223,?,?), ref: 025E0E1E

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 1cacf028484974530ae65c6e85c24824324feaa6d5fdbaaae33983dc66bd837b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 9AD0123114512877DB003A94DC09BCD7F1CDF05B66F008021FB0DE9080C7B0954046E9

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 05478fb9babea3aedd85a8edb4ab166fddf6c1b165fd5123cd32555987dcb6f6
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 05478fb9babea3aedd85a8edb4ab166fddf6c1b165fd5123cd32555987dcb6f6
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 02651B58 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02651BA9

Memory Dump Source

Source File: 00000000.00000002.1760365617.000000000264D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0264D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_264d000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d1ced0da1bc2b1cb4333946a869cc36e531b88a440730cce5febef7716b0ddfa
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: BB113979A00208EFDB01DF98C985E98BBF5AF08351F0580A4FA489B361D371EA90DF84

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

wtm_w, xrefs: 0040C96C
4, xrefs: 0040D9F7
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
lid_file_upd, xrefs: 0040CE6A
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
flags_upd, xrefs: 0040CE4A
\, xrefs: 0040D3A7
.sys, xrefs: 0040D0CC
@, xrefs: 0040D754
\, xrefs: 0040D39D
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
drivers\, xrefs: 0040D067
wtm_r, xrefs: 0040C97F
wtm_c, xrefs: 0040C956
srv_time, xrefs: 0040CABB
local_time, xrefs: 0040CACD

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 08388a96a0613bf8d27a9a5b88df5728e1ce957ca3804cc8d4ec0e6dce1f5215
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 08388a96a0613bf8d27a9a5b88df5728e1ce957ca3804cc8d4ec0e6dce1f5215
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlNtStatusToDosError, xrefs: 00401194
RtlLengthSid, xrefs: 00401246
ntdll.dll, xrefs: 0040100D
NtClose, xrefs: 004011B4
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlFreeSid, xrefs: 00401116
RtlSetLastWin32Error, xrefs: 004010D6
NtSetInformationThread, xrefs: 00401155
RtlInitUnicodeString, xrefs: 00401135
NtOpenProcessToken, xrefs: 004011D4
NtQueryInformationToken, xrefs: 00401262
NtFilterToken, xrefs: 0040122B
NtSetInformationToken, xrefs: 00401175
NtDuplicateToken, xrefs: 004011F3
NtTerminateProcess, xrefs: 004010F6

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Thu, xrefs: 0040B241
Dec, xrefs: 0040B2A3
Nov, xrefs: 0040B29C
Oct, xrefs: 0040B295
Mon, xrefs: 0040B22C
Apr, xrefs: 0040B26B
Jul, xrefs: 0040B280
May, xrefs: 0040B272
Wed, xrefs: 0040B23A
Mar, xrefs: 0040B264
Fri, xrefs: 0040B248
Tue, xrefs: 0040B233
Feb, xrefs: 0040B25D
Sep, xrefs: 0040B28E
Aug, xrefs: 0040B287
Jan, xrefs: 0040B256
Sat, xrefs: 0040B24F
Jun, xrefs: 0040B279
Sun, xrefs: 0040B225

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

<, xrefs: 00401378
, xrefs: 00401462
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
uac, xrefs: 00401628
PDu, xrefs: 0040139A
D, xrefs: 004015C6
wusa.exe, xrefs: 00401388
useless, xrefs: 0040161E

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

start_srv, xrefs: 00401E6C
loader_id, xrefs: 00401F4B, 00401F6B
kernel32, xrefs: 00401DF7
net_type, xrefs: 00401E87
born_date, xrefs: 00401EAD, 00401ECC
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
lid_file_upd, xrefs: 00401E25
IsWow64Process, xrefs: 00401DF2
work_srv, xrefs: 00401E5E
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
hi_id, xrefs: 00401F16, 00401F1B, 00401F33

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 025E65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 025E65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 025E6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 025E6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 025E6652

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 373864ace6abbfffcafdd7fd10633e789074b9677d6f88353d8f0fe976f4afe5
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: EA1191B1600219BFDB259F65DC09F9B3FACFB047A5F104025FA09A7290DBB1DD008AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 025E092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 025E0966
GetProcAddress., xrefs: 025E09DC, 025E09DF, 025E09E4
., xrefs: 025E095F

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: fc5b48697e139aa503d4e7ed2b31dba268f8bea0036869d3efbd2890e3e86d25
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: D13137B6900609DFDB14CF99C880AAEBBF5FF58324F54404AD442B7250D7B1EA45CBA8

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 02651776 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760365617.000000000264D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0264D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_264d000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 986dcdf874dfcc0873addfd17d72cc1818e4dc616ec5052521489a0bf9968e76
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 1D118272340110AFD744DF59DCC0FA673EAEB8A364B198095ED08CB311D675E802C760

Function 025E0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: df0410c61a203207abd4ddf3c82edefc2bc19500901f7bae37740177d3c213eb
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 6E018F76A106048FDF25DF24C904BAE33A5FB86316F4544B5D90BE7281E7B4A9418B94

Function 025E9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 025E9E6D
lstrcpy.KERNEL32(?,00000000), ref: 025E9FE1
lstrcat.KERNEL32(?,?), ref: 025E9FF2
lstrcat.KERNEL32(?,0041070C), ref: 025EA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 025EA054
DeleteFileA.KERNEL32(?), ref: 025EA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 025EA0D6
lstrcpy.KERNEL32 ref: 025EA12F
lstrlen.KERNEL32(00000022), ref: 025EA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 025E9F13

Part of subcall function 025E7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 025E7081

Part of subcall function 025E6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\wukhxvso,025E7043), ref: 025E6F4E
Part of subcall function 025E6F30: GetProcAddress.KERNEL32(00000000), ref: 025E6F55
Part of subcall function 025E6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 025E6F7B
Part of subcall function 025E6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 025E6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 025EA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 025EA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 025EA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 025EA21B
GetDriveTypeA.KERNEL32(?), ref: 025EA265
lstrcat.KERNEL32(?,00000000), ref: 025EA29F
lstrcat.KERNEL32(?,00410A34), ref: 025EA2C5
lstrcat.KERNEL32(?,00000022), ref: 025EA2D9
lstrcat.KERNEL32(?,00410A34), ref: 025EA2F4
wsprintfA.USER32 ref: 025EA31D
lstrcat.KERNEL32(?,00000000), ref: 025EA345
lstrcat.KERNEL32(?,?), ref: 025EA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 025EA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 025EA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 025EA1D1

Part of subcall function 025E9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 025E999D
Part of subcall function 025E9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 025E99BD
Part of subcall function 025E9966: RegCloseKey.ADVAPI32(?), ref: 025E99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 025EA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 025EA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 025EA41D

Strings

", xrefs: 025EA142
P, xrefs: 025EA011
\, xrefs: 025E9F73
", xrefs: 025EA3F0
D, xrefs: 025EA1F5
", xrefs: 025EA2DF

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 4b1be3a0c8320cbc4fc28b6e41c9cdded7a3fa96aa5ccfc2813adf84633cbff9
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 11F150B1D40259AFDF25DBB0CC48EEF7BBDBB48304F1444A6E606E2141E7758A848F69

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 025E7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 025E7D21
GetUserNameA.ADVAPI32(?,?), ref: 025E7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 025E7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 025E7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 025E7DC0
EqualSid.ADVAPI32(?,?), ref: 025E7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 025E7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 025E7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 025E7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 025E7E12
LocalFree.KERNEL32(00000000), ref: 025E7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 025E7E35

Strings

D, xrefs: 025E7D73
PromptOnSecureDesktop, xrefs: 025E7FA0

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: c6f09873c3805284feb27b0d065540eef070ecb9ae4a6319b128c04334f3d38d
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 94A17C71900219AFDF25DFA0DC88FEEBFB9FB08304F048569E516E6150E7758A84CB68

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
12:08:32, xrefs: 00406535
va=%08X%08X uef=%p, xrefs: 00406595
except_info, xrefs: 00406728
%d=%p, xrefs: 004066F9
localcfg, xrefs: 0040672D
plgs:, xrefs: 004066AA
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
Jan 13 2018, xrefs: 0040653A

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ESMTP, xrefs: 0040AA38
., xrefs: 0040A8CA
Too small respons, xrefs: 0040A9C9
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
Too big smtp respons (%d bytes), xrefs: 0040A9B1
localcfg, xrefs: 0040AB0B
data, xrefs: 0040A85E
mail from:<%s>, xrefs: 0040A848
ehlo %s, xrefs: 0040A7F5
Incorrect respons, xrefs: 0040AB39
quit, xrefs: 0040A86C
AUTH LOGIN, xrefs: 0040A80C
helo %s, xrefs: 0040A803
rcpt to:<%s>, xrefs: 0040A855

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 746662ae2e07b1e187343bb9806b09eabb2692b1532a6a4bb231cefe9db8a9a3
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: 746662ae2e07b1e187343bb9806b09eabb2692b1532a6a4bb231cefe9db8a9a3
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 025E7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 025E7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 025E7ACD
GetLengthSid.ADVAPI32(?), ref: 025E7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 025E7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 025E7B1F
EqualSid.ADVAPI32(?,?), ref: 025E7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 025E7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 025E7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 025E7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 025E7B77
LocalFree.KERNEL32(00000000), ref: 025E7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 025E7B9A
GetAce.ADVAPI32(?,?,?), ref: 025E7BCA
EqualSid.ADVAPI32(?,?), ref: 025E7BF1
DeleteAce.ADVAPI32(?,?), ref: 025E7C0A
EqualSid.ADVAPI32(?,?), ref: 025E7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 025E7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 025E7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 025E7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 025E7CE0
LocalFree.KERNEL32(00000000), ref: 025E7CEE

Strings

D, xrefs: 025E7AC3

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: b310a3a8b125a3acc7d31f7b1559025591981f4ba4c088d3b54f87ec39b616db
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: F2812B7190021AABEF25CFA4DD44BEEBFBCBF0C304F04816AE51AE6150E7759645CB68

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f2b0532c569203f409dfb511051bc380affeba1dca504a90a769f383188acf62
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f2b0532c569203f409dfb511051bc380affeba1dca504a90a769f383188acf62
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetAdaptersInfo, xrefs: 004019DC
Iphlpapi.dll, xrefs: 004019B7
GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 025E858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 025E865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 025E867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 025E86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 025E86B1

Strings

", xrefs: 025E896C
PromptOnSecureDesktop, xrefs: 025E85B6, 025E8645, 025E86BD, 025E8708, 025E87C5, 025E8812, 025E88E9, 025E8905

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 0923b23fe54b11b111ed42bbc55020b8abfa771338e35e7e442ce1c66879669b
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: C9C1C2B1D00209BEEF15ABA4DD89EEF7FBDFB54300F144465F502E6060EB714A848B69

Function 025E14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 025E1601
lstrlenW.KERNEL32(-00000003), ref: 025E17D8

Strings

<, xrefs: 025E15DF
@, xrefs: 025E15E7
, xrefs: 025E16C9
D, xrefs: 025E182D

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 6411c629166de4a316ad91131e87f53e6f55888c2b1791c4d39924ee40bdea97
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: E2F18CB15087419FDB24CF64C888BABBBE5FB88704F00892DF59AD7290D7B49D44CB5A

Function 025E7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 025E76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 025E7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 025E778F
___ascii_stricmp.LIBCMT ref: 025E78B4
RegCloseKey.ADVAPI32(?), ref: 025E794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 025E796D
RegCloseKey.ADVAPI32(?), ref: 025E797E
RegCloseKey.ADVAPI32(?), ref: 025E79AC
RegCloseKey.ADVAPI32(?), ref: 025E7A56

Part of subcall function 025EF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,025E772A,?), ref: 025EF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 025E79F6
RegCloseKey.ADVAPI32(?), ref: 025E7A4D

Strings

", xrefs: 025E7800
PromptOnSecureDesktop, xrefs: 025E76C5, 025E76CA, 025E76E5, 025E7782, 025E77E6, 025E7862, 025E787B, 025E79C2

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: dd6e97f73c1990ab52a90ed9f135ec4a51d87441ddcd8b671b251a93e64459d9
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 0DC1837190020AABDF19DFA4DC45FEEBFB9FF59310F1040A5E506E6150EB719A84CB68

Function 025E2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 025E2CED
socket.WS2_32(00000002,00000002,00000011), ref: 025E2D07
htons.WS2_32(00000000), ref: 025E2D42
select.WS2_32 ref: 025E2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 025E2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 025E2E62

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: ddffff7a46212f1a2e8d0bd249d0f013e32ce4a2edbcbd25b09b684216ca84e9
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 3961CF71508315ABDB24AF60DC09B7BBBECFB88745F044819FD86D6254D7B4D8808BAA

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_HST, xrefs: 0040AEC5
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_MID, xrefs: 0040AEAE
%s%d, xrefs: 0040AE58
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
127.0.0.1, xrefs: 0040ADEB

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 025E958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 025E95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 025E95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 025E95DC
wsprintfA.USER32 ref: 025E9635
wsprintfA.USER32 ref: 025E9673
wsprintfA.USER32 ref: 025E96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 025E9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 025E978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 025E97D8

Strings

PromptOnSecureDesktop, xrefs: 025E9604, 025E9624, 025E9662, 025E9683, 025E96B6, 025E96DF, 025E9701, 025E9734, 025E9780, 025E97B7

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: b4791a228ba2d809b2f690eebd052f650d5319d515b8391664f7f022016da54e
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 28A17BB2900249ABEF29DFA0CC45FDA3BADFB44740F104026FA16D2151E7B5D984CFA9

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
86A, xrefs: 0040BF98
smtp_retr, xrefs: 0040BE61, 0040BF8C
06A, xrefs: 0040BF70
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_EMAIL, xrefs: 0040B473
%FROM_EMAIL, xrefs: 0040B3E9
%M5DATE, xrefs: 0040B50F
%FROM_USER, xrefs: 0040B431
%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488
%TO_DOMAIN, xrefs: 0040B44B
%TO_HASH, xrefs: 0040B4B0
%s@%s, xrefs: 0040B461
%FROM_DOMAIN, xrefs: 0040B41E
%P5DATE, xrefs: 0040B4F2

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 491365892f8bb9f782b1eadb0c053184f090b87ac727cff77266b05d33f425ed
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: 491365892f8bb9f782b1eadb0c053184f090b87ac727cff77266b05d33f425ed
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 025E3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 025E3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 025E3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 025E3095
RtlAllocateHeap.NTDLL(00000000), ref: 025E30B6
htons.WS2_32(00000035), ref: 025E30EF
inet_addr.WS2_32(?), ref: 025E30FA
gethostbyname.WS2_32(?), ref: 025E310D
HeapFree.KERNEL32(00000000), ref: 025E314D

Strings

iphlpapi.dll, xrefs: 025E3062, 025E3067, 025E3077

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: d324134c5c4e9bfca9e7fa03fcabbc5990372939809308646a65d40d5d52855e
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 6631A431E00206BBDF199BB89C48BBE7FB8BF04764F1441A9E51AE7290DB74D9418B5C

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 08590bedac40c171af98f9ef71e4763ddedd3488e6be67803c08e43eb8f6ec67
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 08590bedac40c171af98f9ef71e4763ddedd3488e6be67803c08e43eb8f6ec67
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 025E6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 025E67C3
htonl.WS2_32(?), ref: 025E67DF
htonl.WS2_32(?), ref: 025E67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 025E68F1
ExitProcess.KERNEL32 ref: 025E69BC

Strings

localcfg, xrefs: 025E6994
except_info, xrefs: 025E698F

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: e5773fdeb5622d1d62b74c12d11b2f37e8daacd954c8ba42da88e3f2c7131c50
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 95617E72A40208AFDF649FB4DC45FEA7BE9FB48300F148066FA6DD2161EB7599908F14

Function 025EF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(025ECC84), ref: 025EF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 025EF5CE
closesocket.WS2_32(00000000), ref: 025EF5DC

Strings

time_cfg, xrefs: 025EF58A

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 1032d1b826cee421fb3061f14e7967d0950d5fce9d2f1a6c506001ce015045e0
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 663160B1900119ABDB10DFA5EC85DEE7BBCFF88310F104566F916D3150EB709A818BA8

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 50e1d0fd506a25f4fcf020f7626363f0e34832197d4c239b412bec30e638236e
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: 50e1d0fd506a25f4fcf020f7626363f0e34832197d4c239b412bec30e638236e
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 025E2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 025E2FA1
LoadLibraryA.KERNEL32(?), ref: 025E2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 025E2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 025E3000
RtlAllocateHeap.NTDLL(00000000), ref: 025E3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 025E3032

Strings

dnsapi.dll, xrefs: 025E2F90

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 8c02e6f187229336ed978c45e0d6158fde6eb556150a27928978bb5cbd97832c
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 31217C71900229BBCF229B94DC49ABEBFBDFF48B10F004461F906E7140D7B49A8187E8

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 025E6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\wukhxvso,025E7043), ref: 025E6F4E
GetProcAddress.KERNEL32(00000000), ref: 025E6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 025E6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 025E6F92

Strings

\\.\pipe\wukhxvso, xrefs: 025E6F37
C:\Windows\SysWOW64\, xrefs: 025E6F30, 025E6F38, 025E6F65, 025E6F6C, 025E6F7A, 025E6F85, 025E6F91, 025E6FA9, 025E6FC6, 025E6FEC
PromptOnSecureDesktop, xrefs: 025E6F9D, 025E6FBF, 025E6FCF, 025E6FE5, 025E6FF5

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\wukhxvso
API String ID: 1082366364-1686062893
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 2ead2fe5265e6cccd5b5e5ca9a802e43d66a6a1031994f842a083e4686842421
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 6E2138617403413EFF2A5731DC88FFB3E4DAB96764F1840A5F806D5480EBD984D6866E

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 025E92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 025E92E2
wsprintfA.USER32 ref: 025E9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 025E9375
lstrlen.KERNEL32(?,?,00000000), ref: 025E9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 025E9394
CloseHandle.KERNEL32(00000000), ref: 025E939B

Strings

PromptOnSecureDesktop, xrefs: 025E932B, 025E9343, 025E935E

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: f4d9e1310c78de484fa183fb705e2c1beb965daf9058b3192c31138ac2c0bd62
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 89119DB17401147BEB256B31DC0DFEF3A6EEBC8710F00C065BB16E5090EEB44A418A69

Function 025E99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 025E9A18
GetThreadContext.KERNEL32(?,?), ref: 025E9A52
TerminateProcess.KERNEL32(?,00000000), ref: 025E9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 025E9A98
SetThreadContext.KERNEL32(?,00010002), ref: 025E9AB5
ResumeThread.KERNEL32(?), ref: 025E9AC2

Strings

D, xrefs: 025E9A10

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: f1c2065ce2cafc3af22ca24699c6b92e57d7cafcfba8c56bcf0d2c16df5dba60
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 54213D71A01219BBDF119BA1DC09EEFBFBCFF04750F404461BA1AE1050EB758A84CBA8

Function 025E1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 025E1C18
LoadLibraryA.KERNEL32(004102C8), ref: 025E1C26
GetProcessHeap.KERNEL32 ref: 025E1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 025E1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 025E1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 025E1D02
FreeLibrary.KERNEL32(?), ref: 025E1D0B

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 3f3679cb079f64434dee62ad55372c9fd0144f4c76ecf8fe0070730e94c6ad2d
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 85315E31E00219BFCF159FA4DD888EEBFB9FB45305B24847AE50AE6110D7B54E80DB98

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 025E6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 025E6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 025E6D22
GetLastError.KERNEL32 ref: 025E6DA7
CloseHandle.KERNEL32(?), ref: 025E6DB5
GetLastError.KERNEL32 ref: 025E6DD6
DeleteFileA.KERNEL32(?), ref: 025E6DE7
GetLastError.KERNEL32 ref: 025E6DFD

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 02f64e8b94740b522be43c05c228c15ab18c9a190ba2a902a8fde2a26074b25e
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 9E310172900249BFCF05DFA4DE48ADE7F7DFB98350F1480A5E212E3250D7708A858B69

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 025E93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 025E93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 025E93CD
CharToOemA.USER32(?,?), ref: 025E93DB
wsprintfA.USER32 ref: 025E9410

Part of subcall function 025E92CB: GetTempPathA.KERNEL32(00000400,?), ref: 025E92E2
Part of subcall function 025E92CB: wsprintfA.USER32 ref: 025E9350
Part of subcall function 025E92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 025E9375
Part of subcall function 025E92CB: lstrlen.KERNEL32(?,?,00000000), ref: 025E9389
Part of subcall function 025E92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 025E9394
Part of subcall function 025E92CB: CloseHandle.KERNEL32(00000000), ref: 025E939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 025E9448

Strings

PromptOnSecureDesktop, xrefs: 025E93FA, 025E93FF, 025E941C

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: e375900ed1bb6486d4a95c2a243019aef532d7d4b1228624d3706302d9ea62c9
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 810152F69001197BDB21A761DD49EDF3B7CEBD5701F0040A1BB4AE2080EAB496C58F75

Function 025EAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 025EAAE5

Strings

localcfg, xrefs: 025EAD72
, xrefs: 025EABB3

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction ID: 753f7b77fcc690198295260d4a40d4bdd53e88c012304e2c69d7a95f58d7c12f
Opcode Fuzzy Hash: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction Fuzzy Hash: 35715A72A00309AADF298B74DD85FEE3F6EBB40319F244466F907A2090DF6285C4CB5D

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 025EE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 025EDF6C: GetCurrentThreadId.KERNEL32 ref: 025EDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 025EE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,025E6128), ref: 025EE950
lstrcmp.KERNEL32(?,00000008), ref: 025EE989

Strings

A, xrefs: 025EE9A0
A, xrefs: 025EE960, 025EE965
A, xrefs: 025EE8C6, 025EE8CD, 025EE936, 025EE998

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 1a88cd713a3bc56ebe39eccb7922b188e06b67c6db1188bc6f54dbea020d0aa2
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: DD31AA31A107169BCF798F24C886BA67BE8FB15734F00892AE5A7C7550D371E880CB89

Function 025E6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 025E6E19

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 020e12823431d5965ea7972a90c1880a7ba5d61346a31ed422d6a44060689680
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: FA211D72104115BFDF18AB70EC49EDF7FADEB496A5B108465F503D1090EB71DA409678

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 025EC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 025EC6B4
InterlockedIncrement.KERNEL32(025EC74B), ref: 025EC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,025EC747), ref: 025EC728
CloseHandle.KERNEL32(00000000,?,025EC747,00413588,025E8A77), ref: 025EC733

Strings

localcfg, xrefs: 025EC544

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 8b02f0403206de7662327523911b0427919cfec80921682442ddee50d9c7127c
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 8A514CB1A01B418FDB288F69C5D562BBBE9FB88305B50593FE18BC7A90D774E840CB14

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: 8c18a3b068088e326932d6bb7448d6999afe88f1a57d3caa8edfbced1390b2d2
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 8c18a3b068088e326932d6bb7448d6999afe88f1a57d3caa8edfbced1390b2d2
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 025EE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,025EE50A,00000000,00000000,00000000,00020106,00000000,025EE50A,00000000,000000E4), ref: 025EE319
RegSetValueExA.ADVAPI32(025EE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 025EE38E
RegDeleteValueA.ADVAPI32(025EE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 025EE3BF
RegCloseKey.ADVAPI32(025EE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,025EE50A), ref: 025EE3C8

Strings

PromptOnSecureDesktop, xrefs: 025EE33A

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: bad357c0ccc61cd0caf35ac216e2e3cceb5394eefc787abfd030515c858d2e2a
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 04217C71A1021DABDF209FA4EC89EEE7F79FF08760F008021F905E6150E7719A54CBA4

Function 025E71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 025E71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 025E7228
LocalFree.KERNEL32(?,?,?), ref: 025E7286
wsprintfA.USER32 ref: 025E729D

Strings

|, xrefs: 025E721A

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 7e399aa61878840c37983007861a8c4b6168dfaa5e1f558fa2b718171fe13eda
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 31311A72900209BBDF15DFA8DC45BDA7BADFF08314F148066F95ADB100EB75D6488B98

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 025EB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 025EB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 025EB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 025EB548
GetTimeZoneInformation.KERNEL32(?), ref: 025EB590
wsprintfA.USER32 ref: 025EB61E

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 10b2013febbba6dcc5e1e75c368d10b48d909696b07807be27c72f4c1f7bd86d
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 99511FB1D0021DAACF18DFD5D8885EEBBB9BF48305F10856BF505A6150E7B84AC9CF98

Function 025E62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 025E6303
LoadLibraryA.KERNEL32(?), ref: 025E632A
GetProcAddress.KERNEL32(00000000,?), ref: 025E63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 025E6405

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 0166341c598df8cf57d585d772f7dc0af31cf969f38eb52ec9fb0817034b055d
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 6E416DB1A10216EFDF18CF58C884BA9BBB8FF18398F148569E866D7290D771E940CB54

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 025EE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 025EDF6C: GetCurrentThreadId.KERNEL32 ref: 025EDFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,025EA6AC), ref: 025EE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,025EA6AC), ref: 025EE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,025EA6AC), ref: 025EE819

Strings

PromptOnSecureDesktop, xrefs: 025EE840, 025EE845, 025EE87C, 025EE89B

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 5c6848700505fbefec900b5af6b9fc541e0b7cf01d2d3844d26336d2c7974e66
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 4121E7F1A443027AEA247721DC07FEB3E1DEBE5770F100025BA1BA51D2EA9594508ABD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 025E7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 025E76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 025E796D
RegCloseKey.ADVAPI32(?), ref: 025E797E

Strings

PromptOnSecureDesktop, xrefs: 025E76C5, 025E76CA, 025E76E5

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 3f9a05575478d4e20f9aea38b0a96e1cc4cdc3a1839b5b2eaf59457217eeaa59
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 5511AF70A00109AFDF118FA9DC45FAFBF79FB99718F140561F516EA290E7B189408B68

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 025E9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 025E999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 025E99BD
RegCloseKey.ADVAPI32(?), ref: 025E99C6

Strings

PromptOnSecureDesktop, xrefs: 025E9989, 025E998E, 025E99B0, 025E99D3

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 9f49543741207bb97dbf147fc88be86995b5bedf2bd679fd3a5c10bfb68e7f6c
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: C4F09CB2640108BBF7116754EC07FDB3E2DEB95754F104061FA06F5091F6E55A9046FD

Function 025E28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 025E28FA
gethostbyname.WS2_32(u6A), ref: 025E2906

Strings

u6A, xrefs: 025E28EC, 025E28F9, 025E2905
time_cfg, xrefs: 025E28EB

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 25beefd5fa0a6110532e3ab9418d81832a50e9416be7c6c01923a126ba77eabf
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: FCE08C306082218FDB008B28F848AC53BA9BF0A230F018181F851C31A5C7349CC09648

Function 025E69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 025E69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 025E6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 025E6A3A
CloseHandle.KERNEL32(000000FF), ref: 025E6BD8

Part of subcall function 025EEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,025E1DCF,?), ref: 025EEEA8
Part of subcall function 025EEE95: HeapFree.KERNEL32(00000000), ref: 025EEEAF

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: aca50a13f7c203a2d56c6c1e53d83dc25234b9517b21aeaeb4e53dc488bc17a3
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: EB7115B190022DEFDF149FA4CC80AEEBBBDFB04354F1045AAE516A6190D7749E92CB64

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 025E417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 025E41AB
GetLastError.KERNEL32 ref: 025E41B5
WaitForSingleObject.KERNEL32(?,?), ref: 025E41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 025E41D9

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 7325546f40643011e5270622d3e81cad1d1fd68bbd7c9e290fb339c02a1d7dcf
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 0701087691110AAFDF05DF90ED84BEF7BACFB18259F008061F902E2050D770DA648BBA

Function 025E41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 025E421F
GetLastError.KERNEL32 ref: 025E4229
WaitForSingleObject.KERNEL32(?,?), ref: 025E423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 025E424D

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 55b06d1d327631adaf3fb7ab44b6d56ce05e57a159bc593b7ac897402f02b6de
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 1A01C872511109AFDF01DF90ED84BEF7BACFB08255F1084A1F902E2050D770EA549BBA

Function 025EE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 025EE066

Strings

A, xrefs: 025EE036
A, xrefs: 025EE07F
A, xrefs: 025EE037, 025EE03C

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: fdd17aacfea24a38fc4c07ca3680e6a9ea0ca67b5b2e536801fe8761bf10dcd1
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 7AF06232200712DBCF34CF25D884AA2BBE9FB05335B44866AE556C3060D374A499CB59

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 025EE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,025E44E2,00000000,00000000,00000000), ref: 025EE470
CloseHandle.KERNEL32(00000001,00000003), ref: 025EE484

Part of subcall function 025EE2FC: RegCreateKeyExA.ADVAPI32(80000001,025EE50A,00000000,00000000,00000000,00020106,00000000,025EE50A,00000000,000000E4), ref: 025EE319
Part of subcall function 025EE2FC: RegSetValueExA.ADVAPI32(025EE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 025EE38E
Part of subcall function 025EE2FC: RegDeleteValueA.ADVAPI32(025EE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 025EE3BF
Part of subcall function 025EE2FC: RegCloseKey.ADVAPI32(025EE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,025EE50A), ref: 025EE3C8

Strings

PromptOnSecureDesktop, xrefs: 025EE4F1, 025EE4F6, 025EE537, 025EE561

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: dd8d151b11a3e072e3e7ac62087e7e042e8930babcdb681f364299c582cfeb9f
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 9041B2B2D10215BAEF246E51CC47FEB3E6CFF44774F148065FA0BA4091E7B58650DAA8

Function 025E8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 025E83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 025E8477

Part of subcall function 025E69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 025E69E5
Part of subcall function 025E69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 025E6A26
Part of subcall function 025E69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 025E6A3A

Part of subcall function 025EEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,025E1DCF,?), ref: 025EEEA8
Part of subcall function 025EEE95: HeapFree.KERNEL32(00000000), ref: 025EEEAF

Strings

PromptOnSecureDesktop, xrefs: 025E83B2, 025E83B7, 025E8483

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: cd0d6466c9b38358c92c494a1f6a08a9bbd1f81e40c156d52143f554c6f15790
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 344172B2900109BFDF18EBA0DE85EFF7B6DFB44348F0444A6E506D6060E7B15A548B58

Function 025EE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,025EE859,00000000,00020119,025EE859,PromptOnSecureDesktop), ref: 025EE64D
RegCloseKey.ADVAPI32(025EE859,?,?,?,?,000000C8,000000E4), ref: 025EE787

Strings

PromptOnSecureDesktop, xrefs: 025EE637

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 237de98ee643ff751faa13644d4849d0c95ec579afe51b8f6cd9ec323990b307
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 1C4128B2D0021DBFDF11EF94DC82EEEBB7DFB04314F104466EA02A6150E7719A558B64

Function 025EAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 025EAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 025EB00D

Part of subcall function 025EAF6F: gethostname.WS2_32(?,00000080), ref: 025EAF83
Part of subcall function 025EAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 025EAFE6

Part of subcall function 025E331C: gethostname.WS2_32(?,00000080), ref: 025E333F
Part of subcall function 025E331C: gethostbyname.WS2_32(?), ref: 025E3349

Part of subcall function 025EAA0A: inet_ntoa.WS2_32(00000000), ref: 025EAA10

Strings

%OUTLOOK_BND_, xrefs: 025EB076, 025EB07B, 025EB0BE, 025EB0DD

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction ID: cb2f19bfb209e34987e2a253ff2ffa03e015dd080f68d88ab4cc018a9cd5e84c
Opcode Fuzzy Hash: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction Fuzzy Hash: 2D414F7290020DABDF29EFA0DC45EEE3BADFF48304F144426F92692151EA75E6548F58

Function 025E9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 025E9536
Sleep.KERNEL32(000001F4), ref: 025E955D

Strings

, xrefs: 025E94D9

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 83463a513ec37598ada0b568ef7099430e37bb8c7890aa979b0999f417174584
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 9941F3B18083956EEF3E8A64D8887B67FA5BF02314F1801A6D487971A2D7B44D81C759

Function 025EBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 025EB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 025EBA3A
InterlockedIncrement.KERNEL32(?), ref: 025EBA94
GetTickCount.KERNEL32 ref: 025EBB79
GetTickCount.KERNEL32 ref: 025EBB99
InterlockedIncrement.KERNEL32(?), ref: 025EBE15
closesocket.WS2_32(00000000), ref: 025EBEB4

Strings

%FROM_EMAIL, xrefs: 025EBC7D

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 3c855f4e27795f0972e004423acd55466e016c50b491ea3707bfedfa6679f7a9
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: E9316D71800248DFDF29DFA4DC84AEDBBA9FB44705F204456FA2682160DB309685CF19

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 025E709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 025E70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 025E70F4

Strings

|, xrefs: 025E70E6

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: df69b910675fc693c1a6ce6c21f2574b725d9c55d1985d85bf52cdfddf093c59
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 7E112E72900258EBDF19CBD4DC84ADEB7BCBB08305F1451A6E502E6054E7709744EBA5

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: eb36c4684a50d41e83146847fb5b55aa5c7421795727ebfadd0c8b1e870b45ea
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: eb36c4684a50d41e83146847fb5b55aa5c7421795727ebfadd0c8b1e870b45ea
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.1758477438.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1758477438.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 025E3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025E2F88: GetModuleHandleA.KERNEL32(?), ref: 025E2FA1
Part of subcall function 025E2F88: LoadLibraryA.KERNEL32(?), ref: 025E2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 025E31DA
HeapFree.KERNEL32(00000000), ref: 025E31E1

Memory Dump Source

Source File: 00000000.00000002.1760247720.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25e0000_ewdWlNc8TL.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 8f552b7992a4acaadc52c7d6283ae96e8e569a8fec01425ed63b8b56510599d7
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 73516D7190024AAFCF099F64D884AFABB75FF45305F1445A9EC96C7210E732DA19CB98

Analysis Process: ybuffopp.exePID: 4048, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	0%
Total number of Nodes:	1562
Total number of Limit Nodes:	13

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\ewdWlNc8TL.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

\, xrefs: 00409D0C
D, xrefs: 00409F8E
rpfcsqnj, xrefs: 0040A389, 0040A397
", xrefs: 00409EDB
P, xrefs: 00409DAA
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A189
C:\Users\user\Desktop\ewdWlNc8TL.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
", xrefs: 0040A078
C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 0040A1D9

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\ewdWlNc8TL.exe$C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe$D$P$\$rpfcsqnj
API String ID: 2089075347-2046649171
Opcode ID: 74ed254e80b92ce2a67cd9b5d092285e1d886697e7539b718069182a3e242c6b
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 74ed254e80b92ce2a67cd9b5d092285e1d886697e7539b718069182a3e242c6b
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: fb0f2a9e6fd52b701184d9b1120ae1b26139c4ce9695fa828964d471d7998326
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: fb0f2a9e6fd52b701184d9b1120ae1b26139c4ce9695fa828964d471d7998326
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0255003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0255024D

Strings

cess, xrefs: 0255018D
kernel32.dll, xrefs: 0255008F, 02550095

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: d4367e16267fe39940be7016af56db0703376a54c78866face186bf6b1dcdb2f
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B6526B74A01229DFDB64CF58C995BACBBB1BF09314F1480DAE94DAB351DB30AA85CF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 025DDB41 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025DDB69
Module32First.KERNEL32(00000000,00000224), ref: 025DDB89

Memory Dump Source

Source File: 0000000B.00000002.1773773019.00000000025D9000.00000040.00000020.00020000.00000000.sdmp, Offset: 025D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_25d9000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 02f53fd00a22e67c21181beb5221992bf5413c544c1bca76b6e7ff1fd7c8e3aa
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 5AF062365017116BE7302AFDA88DB7A7AF8BF49668F100528E646920C0DB70E8454A69

Function 02550E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02550223,?,?), ref: 02550E19
SetErrorMode.KERNELBASE(00000000,?,?,02550223,?,?), ref: 02550E1E

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 0a691935fcb4c5b5a949147956b2719d15e56e8ab85107f5cb4592576584c2a3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: A9D0123114512877D7002AD4DC09BCD7F1CDF09B66F108011FB0DD9080C770954046E9

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 05478fb9babea3aedd85a8edb4ab166fddf6c1b165fd5123cd32555987dcb6f6
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 05478fb9babea3aedd85a8edb4ab166fddf6c1b165fd5123cd32555987dcb6f6
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 025DD800 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025DD851

Memory Dump Source

Source File: 0000000B.00000002.1773773019.00000000025D9000.00000040.00000020.00020000.00000000.sdmp, Offset: 025D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_25d9000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9ff407aad0ce76bd86226863c5820f6261b7f236b954dbbfbe818c6c4541974a
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A4112879A40208EFDB01DF98C985E98BBF5AF08751F0580A4F9489B361D371EA90DF84

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 025565E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 025565F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02556610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02556631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02556652

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 375ec10b23e9159f10f2768afae257a28a04dff4e958961fe7cffd06c488ae20
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 7E1191B1600269BFDB219F65DC15F9B3FACFB057A5F004025FE08A7250D7B1DD008AA8

Function 02559EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02559E6D
lstrcpy.KERNEL32(?,00000000), ref: 02559FE1
lstrcat.KERNEL32(?,?), ref: 02559FF2
lstrcat.KERNEL32(?,0041070C), ref: 0255A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0255A054
DeleteFileA.KERNEL32(?), ref: 0255A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0255A0D6
lstrcpy.KERNEL32 ref: 0255A12F
lstrlen.KERNEL32(00000022), ref: 0255A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 02559F13

Part of subcall function 02557029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02557081

Part of subcall function 02556F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\wukhxvso,02557043), ref: 02556F4E
Part of subcall function 02556F30: GetProcAddress.KERNEL32(00000000), ref: 02556F55
Part of subcall function 02556F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02556F7B
Part of subcall function 02556F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02556F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0255A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0255A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0255A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0255A21B
GetDriveTypeA.KERNEL32(?), ref: 0255A265
lstrcat.KERNEL32(?,00000000), ref: 0255A29F
lstrcat.KERNEL32(?,00410A34), ref: 0255A2C5
lstrcat.KERNEL32(?,00000022), ref: 0255A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0255A2F4
wsprintfA.USER32 ref: 0255A31D
lstrcat.KERNEL32(?,00000000), ref: 0255A345
lstrcat.KERNEL32(?,?), ref: 0255A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0255A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0255A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0255A1D1

Part of subcall function 02559966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0255999D
Part of subcall function 02559966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 025599BD
Part of subcall function 02559966: RegCloseKey.ADVAPI32(?), ref: 025599C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0255A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0255A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0255A41D

Strings

\, xrefs: 02559F73
", xrefs: 0255A3F0
", xrefs: 0255A142
P, xrefs: 0255A011
D, xrefs: 0255A1F5
", xrefs: 0255A2DF

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 4aeff626e14379018db9d085afbce6625c22e4d17a3322adee6b6c8a35d0600e
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 19F140B1C4026AEFDF11DBA0DC58EEE7BBCBF08304F1445A6EA05E2151E77596848F68

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

ntdll.dll, xrefs: 0040100D
NtQueryInformationToken, xrefs: 00401262
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlNtStatusToDosError, xrefs: 00401194
RtlFreeSid, xrefs: 00401116
RtlInitUnicodeString, xrefs: 00401135
NtTerminateProcess, xrefs: 004010F6
NtSetInformationThread, xrefs: 00401155
RtlSetLastWin32Error, xrefs: 004010D6
NtClose, xrefs: 004011B4
NtOpenProcessToken, xrefs: 004011D4
NtDuplicateToken, xrefs: 004011F3
NtFilterToken, xrefs: 0040122B
NtSetInformationToken, xrefs: 00401175
RtlLengthSid, xrefs: 00401246

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Mon, xrefs: 0040B22C
Feb, xrefs: 0040B25D
Thu, xrefs: 0040B241
Jul, xrefs: 0040B280
Apr, xrefs: 0040B26B
Mar, xrefs: 0040B264
Sat, xrefs: 0040B24F
Wed, xrefs: 0040B23A
Jun, xrefs: 0040B279
Oct, xrefs: 0040B295
Tue, xrefs: 0040B233
Jan, xrefs: 0040B256
Dec, xrefs: 0040B2A3
Sep, xrefs: 0040B28E
Fri, xrefs: 0040B248
Nov, xrefs: 0040B29C
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Aug, xrefs: 0040B287
May, xrefs: 0040B272
Sun, xrefs: 0040B225

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe$D
API String ID: 2976863881-1637623080
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 02557CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02557D21
GetUserNameA.ADVAPI32(?,?), ref: 02557D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02557D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02557DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02557DC0
EqualSid.ADVAPI32(?,?), ref: 02557DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 02557DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02557DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02557E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02557E12
LocalFree.KERNEL32(00000000), ref: 02557E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02557E35

Strings

D, xrefs: 02557D73
C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 02557F49, 02557F76, 02557F8A, 02557F8B

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe$D
API String ID: 2976863881-1637623080
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: bb088418f04ca9e6b8b8f0ecd873fb49a21a2fe3488d5f3dd09044361a556185
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 7BA14E71900229AFDB11CFA1DD98FEEBFB9FF08304F04816AE905E6150D7759A85CB68

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

except_info, xrefs: 00406728
va=%08X%08X uef=%p, xrefs: 00406595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
plgs:, xrefs: 004066AA
localcfg, xrefs: 0040672D
Jan 13 2018, xrefs: 0040653A
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
%d=%p, xrefs: 004066F9
12:08:32, xrefs: 00406535
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Incorrect respons, xrefs: 0040AB39
., xrefs: 0040A8CA
AUTH LOGIN, xrefs: 0040A80C
quit, xrefs: 0040A86C
data, xrefs: 0040A85E
ehlo %s, xrefs: 0040A7F5
helo %s, xrefs: 0040A803
mail from:<%s>, xrefs: 0040A848
rcpt to:<%s>, xrefs: 0040A855
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
localcfg, xrefs: 0040AB0B
ESMTP, xrefs: 0040AA38
Too small respons, xrefs: 0040A9C9
Too big smtp respons (%d bytes), xrefs: 0040A9B1

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 746662ae2e07b1e187343bb9806b09eabb2692b1532a6a4bb231cefe9db8a9a3
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: 746662ae2e07b1e187343bb9806b09eabb2692b1532a6a4bb231cefe9db8a9a3
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 02557A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02557A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02557ACD
GetLengthSid.ADVAPI32(?), ref: 02557ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02557B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02557B1F
EqualSid.ADVAPI32(?,?), ref: 02557B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 02557B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02557B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02557B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02557B77
LocalFree.KERNEL32(00000000), ref: 02557B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02557B9A
GetAce.ADVAPI32(?,?,?), ref: 02557BCA
EqualSid.ADVAPI32(?,?), ref: 02557BF1
DeleteAce.ADVAPI32(?,?), ref: 02557C0A
EqualSid.ADVAPI32(?,?), ref: 02557C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 02557CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02557CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02557CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02557CE0
LocalFree.KERNEL32(00000000), ref: 02557CEE

Strings

D, xrefs: 02557AC3

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 89b8c9112a6d15c0351ddb20434d678db6ad8a0ebccfb80029827128500c0bdb
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 4E814D7190022AAFDB11CFA5DD98FEEBFB8BF0C304F04806AE915E6150E7759641CB68

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe$localcfg
API String ID: 237177642-125568393
Opcode ID: c0ed8608904dbf5daae194d8f805c8f7c37291116167fddd5df035c008f9e7d4
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: c0ed8608904dbf5daae194d8f805c8f7c37291116167fddd5df035c008f9e7d4
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

D, xrefs: 004015C6
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388
useless, xrefs: 0040161E
@, xrefs: 00401380
uac, xrefs: 00401628
PDu, xrefs: 0040139A
, xrefs: 00401462
<, xrefs: 00401378

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

kernel32, xrefs: 00401DF7
loader_id, xrefs: 00401F4B, 00401F6B
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
born_date, xrefs: 00401EAD, 00401ECC
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
IsWow64Process, xrefs: 00401DF2
work_srv, xrefs: 00401E5E
start_srv, xrefs: 00401E6C
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
net_type, xrefs: 00401E87
lid_file_upd, xrefs: 00401E25

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

localcfg, xrefs: 004019A3
Iphlpapi.dll, xrefs: 004019B7
123.45.67.89, xrefs: 004019A6
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 0255858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0255865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0255867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 025586A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 025586B1

Strings

C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 0255882F, 0255883C, 0255884C
", xrefs: 0255896C

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe
API String ID: 237177642-2234931768
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: b7f2f9d896024cacd44712e8e55a06a9376353ef7e08d1877bb3debaaffcefd5
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 00C1A071900229BEEB11ABA4DD99EEF7FBDFB44304F144467FA01E2050E7714AC48B69

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 025514E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02551601
lstrlenW.KERNEL32(-00000003), ref: 025517D8

Strings

<, xrefs: 025515DF
@, xrefs: 025515E7
, xrefs: 025516C9
D, xrefs: 0255182D

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: d3c4f5a0d68bc49641799e4f943feabc95521cd10064c673142f48e2a2c710fc
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: F0F1B0B11087519FD720CF64C898BABBBF5FB88304F00892EF99997290D7B4D944CB5A

Function 02557666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 025576D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02557757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0255778F
___ascii_stricmp.LIBCMT ref: 025578B4
RegCloseKey.ADVAPI32(?), ref: 0255794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0255796D
RegCloseKey.ADVAPI32(?), ref: 0255797E
RegCloseKey.ADVAPI32(?), ref: 025579AC
RegCloseKey.ADVAPI32(?), ref: 02557A56

Part of subcall function 0255F40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,0255772A,?), ref: 0255F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 025579F6
RegCloseKey.ADVAPI32(?), ref: 02557A4D

Strings

", xrefs: 02557800

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 173a67ab882b4fb3da1389a77d8009ad8f775c982b6e32fc5d5f5bcf50ff7b9d
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 57C1727190022AAFDB11DBA4DC54FEEBFB9FF49310F1440A7E904E6150EB759A84CB68

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 844d959b869107477598dc7fc3fd0898fc590bab3c8716b4da34f6361cc296a8
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 844d959b869107477598dc7fc3fd0898fc590bab3c8716b4da34f6361cc296a8
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 02552CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02552CED
socket.WS2_32(00000002,00000002,00000011), ref: 02552D07
htons.WS2_32(00000000), ref: 02552D42
select.WS2_32 ref: 02552D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 02552DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02552E62

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: db69782b38b75a8192ed9ed6b1bbce063b8f903a1c507dc97b345c0606ee2c4b
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: D361BF72508325ABC7209F64DC18B6BBBE8FF88755F04481AFD85D7250D7B598808BAA

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
%s%d, xrefs: 0040AE58

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 97af48ab48525fb617f5abd17424ad614edf633f88179256e16c2771f2badf11
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: 97af48ab48525fb617f5abd17424ad614edf633f88179256e16c2771f2badf11
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%P5DATE, xrefs: 0040B4F2
%s@%s, xrefs: 0040B461
%TO_HASH, xrefs: 0040B4B0
%DATE, xrefs: 0040B4D2
%FROM_USER, xrefs: 0040B431
%TO_EMAIL, xrefs: 0040B473
%M5DATE, xrefs: 0040B50F
%TO_DOMAIN, xrefs: 0040B44B
%TO_USER, xrefs: 0040B488
%FROM_DOMAIN, xrefs: 0040B41E
%FROM_EMAIL, xrefs: 0040B3E9

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 491365892f8bb9f782b1eadb0c053184f090b87ac727cff77266b05d33f425ed
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: 491365892f8bb9f782b1eadb0c053184f090b87ac727cff77266b05d33f425ed
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 02553059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02553068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02553078
GetProcAddress.KERNEL32(00000000,00410408), ref: 02553095
RtlAllocateHeap.NTDLL(00000000), ref: 025530B6
htons.WS2_32(00000035), ref: 025530EF
inet_addr.WS2_32(?), ref: 025530FA
gethostbyname.WS2_32(?), ref: 0255310D
HeapFree.KERNEL32(00000000), ref: 0255314D

Strings

iphlpapi.dll, xrefs: 02553062, 02553067, 02553077

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 5a7a8df0a2a8c4f3c4c468a4c24b9b3aba9ebfe1cb6d4b1774a06d515f89b76d
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 7231A431E00216BBDB119BB89C58BAE7FB8BF047A4F1441A6ED1CE7290DB74D5418B6C

Function 0255958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 025595A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 025595D5
GetModuleFileNameA.KERNEL32(00000000), ref: 025595DC
wsprintfA.USER32 ref: 02559635
wsprintfA.USER32 ref: 02559673
wsprintfA.USER32 ref: 025596F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02559758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0255978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 025597D8

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: d86045c406c616d831b8ab760971a0e25ce5646102373627569f644e9b6e55ec
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: D8A16AB2900229EBEB21DFA0CC54FDA3BADBB44740F104027FE05E6151E7B99584CFA8

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 02556778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 025567C3
htonl.WS2_32(?), ref: 025567DF
htonl.WS2_32(?), ref: 025567EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 025568F1
ExitProcess.KERNEL32 ref: 025569BC

Strings

localcfg, xrefs: 02556994
except_info, xrefs: 0255698F

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: a248e77f6fae2a168c641ce5cf1d94b423f3bc07ebddf6edcdcd6bd89353d73f
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 55616D72A40218AFDB609FA4DC45FEA7BF9FB48300F148066FA69D2161EB7599908F14

Function 0255F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0255CC84), ref: 0255F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0255F5CE
closesocket.WS2_32(00000000), ref: 0255F5DC

Strings

time_cfg, xrefs: 0255F58A

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 67931875e3c47787546e71c9aaaf17cd40da3ff3f49a04a609325a905c62b3d1
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: B7315C76900129ABDB10DFA5EC88DEE7BFCFF89310F104566F915D3150E7709A818BA8

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 50e1d0fd506a25f4fcf020f7626363f0e34832197d4c239b412bec30e638236e
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: 50e1d0fd506a25f4fcf020f7626363f0e34832197d4c239b412bec30e638236e
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 02552F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02552FA1
LoadLibraryA.KERNEL32(?), ref: 02552FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02552FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02553000
RtlAllocateHeap.NTDLL(00000000), ref: 02553007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02553032

Strings

dnsapi.dll, xrefs: 02552F90

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 33ae2f8b1cc249626bdf9cf9c8b6c94aa53afc86925c8833eaa402c793af5a50
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 07216071D01629BBCB219B55DC59AAEBFB8FF08B50F008462FD05E7150D7B49A8187E8

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 08590bedac40c171af98f9ef71e4763ddedd3488e6be67803c08e43eb8f6ec67
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 08590bedac40c171af98f9ef71e4763ddedd3488e6be67803c08e43eb8f6ec67
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 025599E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02559A18
GetThreadContext.KERNEL32(?,?), ref: 02559A52
TerminateProcess.KERNEL32(?,00000000), ref: 02559A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02559A98
SetThreadContext.KERNEL32(?,00010002), ref: 02559AB5
ResumeThread.KERNEL32(?), ref: 02559AC2

Strings

D, xrefs: 02559A10

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 7407d41502b22c494df47d9bda705a0c473c628cecdfc161585a2ce36d94febc
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 26212C71901129BBDF119BA1DC09EEFBFBCFF05750F404062BA19E1050E7758A84CAA8

Function 02551C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02551C18
LoadLibraryA.KERNEL32(004102C8), ref: 02551C26
GetProcessHeap.KERNEL32 ref: 02551C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02551C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02551CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 02551D02
FreeLibrary.KERNEL32(?), ref: 02551D0B

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: dc875aab538dd5d524197ecf27ad575f4ba9e8f90c6ebc701cd88c19699533f8
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 76316F31D00229BFCB119FE4DC98AFEBFB9FB45345B24847AE905A6110D7B54E80DB98

Function 02556CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02556CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02556D22
GetLastError.KERNEL32 ref: 02556DA7
CloseHandle.KERNEL32(?), ref: 02556DB5
GetLastError.KERNEL32 ref: 02556DD6
DeleteFileA.KERNEL32(?), ref: 02556DE7
GetLastError.KERNEL32 ref: 02556DFD

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 1d2f9a4ad81c8df73bf7c559196408a5d498bdbe782a30da7f60822a630302e1
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: CC310272800199BFCB019FA4DD54AEE7F7DFB48310F048566EA11A3210D7709A418B69

Function 02556F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\wukhxvso,02557043), ref: 02556F4E
GetProcAddress.KERNEL32(00000000), ref: 02556F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02556F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02556F92

Strings

C:\Windows\SysWOW64\, xrefs: 02556F30, 02556F38, 02556F65, 02556F6C, 02556F7A, 02556F85, 02556F91, 02556FA9, 02556FC6, 02556FEC
\\.\pipe\wukhxvso, xrefs: 02556F37

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\wukhxvso
API String ID: 1082366364-1563880823
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 8325501f1412537efc1843317e380ca9701e761163f19ba3cfb60b74a679fc7a
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 14212621B403613AF7225331DCA8FFB2E8DAF56714F1840A7FC04D64A0EBD994D6866D

Function 0255AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0255AAE5

Strings

, xrefs: 0255ABB3
localcfg, xrefs: 0255AD72

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction ID: 485542460a3e4059ea5f42ed057a81d6d19882dda1e7246d50a3b641b7107022
Opcode Fuzzy Hash: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction Fuzzy Hash: 9F716A72A00339AADF21AB54DCA5FEE3B69BB40318F244627FD05A6090DF7295C4CB5D

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0255E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0255DF6C: GetCurrentThreadId.KERNEL32 ref: 0255DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0255E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02556128), ref: 0255E950
lstrcmp.KERNEL32(?,00000008), ref: 0255E989

Strings

A, xrefs: 0255E9A0
A, xrefs: 0255E8C6, 0255E8CD, 0255E936, 0255E998
A, xrefs: 0255E960, 0255E965

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 196c98c6c456fc71b1d3e30ff71524d686f7795bab2c95cb1a9030299f91557c
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 6D31BE31A007269BCB718F24C895BA67FF4FF05724F00892BE99587550D370EA80CB89

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 02556E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02556E19

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 2d2fb218cbec25b232a65bb86ed340f92df2a75b3d704b33c24014f6636f8974
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 78215E72105125BFDB109BB0FC59EDF3FADFB49265B508426F902D1090EB70DA409678

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 025592CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 025592E2
wsprintfA.USER32 ref: 02559350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02559375
lstrlen.KERNEL32(?,?,00000000), ref: 02559389
WriteFile.KERNEL32(00000000,?,00000000), ref: 02559394
CloseHandle.KERNEL32(00000000), ref: 0255939B

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: a81f8b92aa0233bdeed7817951a527d9d11d7ad2dea247ccfef1f0e8ab49498c
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 811187B1740124BBE7216731DC0DFEF3A6EEFC5B14F008066BF06E5090EEB45A418AA8

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 0255C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0255C6B4
InterlockedIncrement.KERNEL32(0255C74B), ref: 0255C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0255C747), ref: 0255C728
CloseHandle.KERNEL32(00000000,?,0255C747,00413588,02558A77), ref: 0255C733

Strings

localcfg, xrefs: 0255C544

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 51653a8d52b54af6d2c8de56963742dd8549953ef516e50fb89b1e87d0b6b026
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: D7516DB1A01B518FC7248F69C5E462ABBE9FB48305B50693FE58BC7A90D774F940CB14

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe
API String ID: 124786226-3712984543
Opcode ID: eb9e4b690bf89fd9b5ecc7cfd1228528b84d28a347e991db18a559738f185d55
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: eb9e4b690bf89fd9b5ecc7cfd1228528b84d28a347e991db18a559738f185d55
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 025571C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 025571E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02557228
LocalFree.KERNEL32(?,?,?), ref: 02557286
wsprintfA.USER32 ref: 0255729D

Strings

|, xrefs: 0255721A

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 6bd65e7d562a84664f1fc6b07bef264b20c1450eac9597302b191f6942824f2a
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: B6313A72900219BBCB01DFA8DC54BDA7BACFF08314F148066FC59DB100EB75D6488B98

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 0255B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0255B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0255B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0255B548
GetTimeZoneInformation.KERNEL32(?), ref: 0255B590
wsprintfA.USER32 ref: 0255B61E

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 90e43e5892f56de982e401d067374833bf7c759ae2a164c2616ddc45c37ccafc
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: E2511FB1D0021DAACF18DFD5D8885EEBBB9BF48304F10856BF505A6150E7B84AC9CF98

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 025562D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 02556303
LoadLibraryA.KERNEL32(?), ref: 0255632A
GetProcAddress.KERNEL32(00000000,?), ref: 025563B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 02556405

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: d25d7c87cb5ac4d9d809bf3fd3641f44578305537b41706611ff5125d6931bfe
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 5B417C71A10266EFDB14CF58C8A4BADBBB8FF04358F59846AEC15D7290E730E940CB54

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 025593AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 025593C6
GetModuleFileNameA.KERNEL32(00000000), ref: 025593CD
CharToOemA.USER32(?,?), ref: 025593DB
wsprintfA.USER32 ref: 02559410

Part of subcall function 025592CB: GetTempPathA.KERNEL32(00000400,?), ref: 025592E2
Part of subcall function 025592CB: wsprintfA.USER32 ref: 02559350
Part of subcall function 025592CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02559375
Part of subcall function 025592CB: lstrlen.KERNEL32(?,?,00000000), ref: 02559389
Part of subcall function 025592CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 02559394
Part of subcall function 025592CB: CloseHandle.KERNEL32(00000000), ref: 0255939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02559448

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: c3b8164e8305dec7fa6e49de288b61a6742dafa99773398e2faec179e45515d6
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 770156F6900119BBD7219761DD49EDF377CEB95701F0040A2BB49E2040DAB496C58F75

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 025528EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 025528FA
gethostbyname.WS2_32(u6A), ref: 02552906

Strings

u6A, xrefs: 025528EC, 025528F9, 02552905
time_cfg, xrefs: 025528EB

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 3c768ea3114f80cb791cddfe3362118337100204fb06fa799175378c37725ea9
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 96E012306086219FDB509B2CF888AD57BE5FF4A230F058596FC54D72A1D778DCC19758

Function 025569C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 025569E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 02556A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 02556A3A
CloseHandle.KERNEL32(000000FF), ref: 02556BD8

Part of subcall function 0255EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02551DCF,?), ref: 0255EEA8
Part of subcall function 0255EE95: HeapFree.KERNEL32(00000000), ref: 0255EEAF

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: dbc27ea90673a60f99e98c24b51b7eb7c7b5b93527308b4a210aae21e84e0227
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 63714771D0026DEFDF10CFA4CC90AEEBBB9FB08324F50456AE915A6190D7349E92CB64

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 0255E2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0255E50A,00000000,00000000,00000000,00020106,00000000,0255E50A,00000000,000000E4), ref: 0255E319
RegSetValueExA.ADVAPI32(0255E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0255E38E
RegDeleteValueA.ADVAPI32(0255E50A,?,?,?,?,?,000000C8,004122F8), ref: 0255E3BF
RegCloseKey.ADVAPI32(0255E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0255E50A), ref: 0255E3C8

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 8efdac7ff3a3620a4ae0a58a31b8656b3b29a9b7ca56e3aa34008e31fb650e1e
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: F5217C71A0022DABDF209FA4EC99EEE7F79FF09750F018022FD04A6050E3719A54CBA4

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 0255417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 025541AB
GetLastError.KERNEL32 ref: 025541B5
WaitForSingleObject.KERNEL32(?,?), ref: 025541C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 025541D9

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: c9b4eb6fad90723c85df3f8c52208413a117515a5ed95764c9c2a0c9f60d98d2
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 3D01E97651111AABDF01DF90ED84BEE7F6CFB18295F008062F901E2150D7709AA48BB9

Function 025541F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0255421F
GetLastError.KERNEL32 ref: 02554229
WaitForSingleObject.KERNEL32(?,?), ref: 0255423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0255424D

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: ec720cc6585e8264a15b2c4cdab9e741ba52c2feaa89388e01c06e8541f7539b
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 3F01C872511129AFDF01DF91ED84BEF7BACFB08255F108462F901E2050DB70DA948BBA

Function 0255E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0255E066

Strings

A, xrefs: 0255E07F
A, xrefs: 0255E037, 0255E03C
A, xrefs: 0255E036

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 5edfe5bd9e8b8a43c30cf02265f30400b1a73c0e89c9a9f80757f989dc02d821
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 87F06271600722DBCB20CF25D894AA2BBE9FF05325B44862BE954C3070D374A599CB59

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 02558330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 025583C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02558477

Part of subcall function 025569C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 025569E5
Part of subcall function 025569C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 02556A26
Part of subcall function 025569C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 02556A3A

Part of subcall function 0255EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02551DCF,?), ref: 0255EEA8
Part of subcall function 0255EE95: HeapFree.KERNEL32(00000000), ref: 0255EEAF

Strings

C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 0255848C, 025584A1

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe
API String ID: 359188348-3712984543
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 62a8e3024d0e5f5a74bfb3280bf51171b559c1b300f03d35b5055d0100af021a
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: D64171B2900129BFEB20EBA4DD94EFF7B6DFB44348F0444A7ED44D6010E7B05A958B68

Function 0255AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0255AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0255B00D

Part of subcall function 0255AF6F: gethostname.WS2_32(?,00000080), ref: 0255AF83
Part of subcall function 0255AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0255AFE6

Part of subcall function 0255331C: gethostname.WS2_32(?,00000080), ref: 0255333F
Part of subcall function 0255331C: gethostbyname.WS2_32(?), ref: 02553349

Part of subcall function 0255AA0A: inet_ntoa.WS2_32(00000000), ref: 0255AA10

Strings

%OUTLOOK_BND_, xrefs: 0255B076, 0255B07B, 0255B0BE, 0255B0DD

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction ID: 7b2abada95faa7e2d4244349b2ce2fe6a9d984b2825fe7c63b7729cdf0af58f2
Opcode Fuzzy Hash: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction Fuzzy Hash: 0C416E7290021CABDB21EFA0DC55EEE3BADFF48304F144427FE2592161EA75E6448F58

Function 02559452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02559536
Sleep.KERNEL32(000001F4), ref: 0255955D

Strings

, xrefs: 025594D9

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: c2efe0836a452ffd99d41d23c54f51b07226bf2f82c640e1540dc79de8872576
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 1C4127B18043A5EEEB328B64D8A87B63FA4BF02314F1800A7DC8247192D77C4D80C799

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 0255BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0255B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0255BA3A
InterlockedIncrement.KERNEL32(?), ref: 0255BA94
GetTickCount.KERNEL32 ref: 0255BB79
GetTickCount.KERNEL32 ref: 0255BB99
InterlockedIncrement.KERNEL32(?), ref: 0255BE15
closesocket.WS2_32(00000000), ref: 0255BEB4

Strings

%FROM_EMAIL, xrefs: 0255BC7D

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 289a9e273486a4d91ec9932419f154e232308d3ea20b282ef4fae5bd6b71a3f3
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 3A316971400258DFDF25DFA4DCA8AE9BBA9FB48704F24445BFE2482164EB709A85CF18

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 0255709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 025570BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 025570F4

Strings

|, xrefs: 025570E6

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 1b02d12930e25fc4f16766216405924a704927cfa654baffc3fcf8bb8fd2e14e
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: FC11FA72900128EBDB11CBD6DC84EDEBBBDBB08715F1441A6E901E6194D7709B88CBA4

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: eb36c4684a50d41e83146847fb5b55aa5c7421795727ebfadd0c8b1e870b45ea
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: eb36c4684a50d41e83146847fb5b55aa5c7421795727ebfadd0c8b1e870b45ea
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000B.00000002.1772595073.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 02553189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02552F88: GetModuleHandleA.KERNEL32(?), ref: 02552FA1
Part of subcall function 02552F88: LoadLibraryA.KERNEL32(?), ref: 02552FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 025531DA
HeapFree.KERNEL32(00000000), ref: 025531E1

Memory Dump Source

Source File: 0000000B.00000002.1773632508.0000000002550000.00000040.00001000.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2550000_ybuffopp.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: c75d6c3c9f8adf130c3796e7eb664a758be2a15f51e01ccc2253792064da30bc
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 7051A03190026AEFCB01DF64D8949F9BB75FF05344F1445AAEC9AC7210E732DA19CB98

Analysis Process: svchost.exePID: 7276, Parent PID: 4048COMMON

Execution Graph

Execution Coverage:	14.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 02F8C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02F8CA4E
closesocket.WS2_32(?), ref: 02F8CB63
GetTempPathA.KERNEL32(00000120,?), ref: 02F8CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02F8CCB4
WriteFile.KERNEL32(02F8A4B3,?,-000000E8,?,00000000), ref: 02F8CCDC
CloseHandle.KERNEL32(02F8A4B3), ref: 02F8CCED
wsprintfA.USER32 ref: 02F8CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02F8CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 02F8CD89
CloseHandle.KERNEL32(?), ref: 02F8CD98
CloseHandle.KERNEL32(?), ref: 02F8CD9D
DeleteFileA.KERNEL32(?), ref: 02F8CDC4
CloseHandle.KERNEL32(02F8A4B3), ref: 02F8CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02F8CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02F8CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02F8D033
lstrcatA.KERNEL32(?,04700108), ref: 02F8D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 02F8D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 02F8D171
WriteFile.KERNEL32(00000000,0470012C,?,?,00000000), ref: 02F8D195
CloseHandle.KERNEL32(00000000), ref: 02F8D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 02F8D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02F8D231
lstrcatA.KERNEL32(?,04700108,?,?,?,?,?,?,?,00000100), ref: 02F8D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02F8D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02F8D2C7
WriteFile.KERNEL32(00000000,0470012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02F8D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02F8D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02F8D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02F8D372
lstrcatA.KERNEL32(?,04700108,?,?,?,?,?,?,?,00000100), ref: 02F8D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02F8D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02F8D408
WriteFile.KERNEL32(00000000,0470012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02F8D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02F8D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02F8D45B
CreateProcessA.KERNEL32(?,02F90264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02F8D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02F8D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02F8D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02F8D513
closesocket.WS2_32(?), ref: 02F8D56C
Sleep.KERNEL32(000003E8), ref: 02F8D577
ExitProcess.KERNEL32 ref: 02F8D583
wsprintfA.USER32 ref: 02F8D81F

Part of subcall function 02F8C65C: send.WS2_32(00000000,?,00000000), ref: 02F8C74B

closesocket.WS2_32(?), ref: 02F8DAD5

Strings

drivers\, xrefs: 02F8D067
except_info, xrefs: 02F8D8CD, 02F8D8D2, 02F8D8FB
@, xrefs: 02F8D754
flags_upd, xrefs: 02F8CE4A
\, xrefs: 02F8D39D
time_cfg, xrefs: 02F8C95B, 02F8C962, 02F8C971, 02F8C984
localcfg, xrefs: 02F8CA89, 02F8CA93, 02F8CAC0, 02F8CAD2, 02F8CE4F, 02F8CE6F, 02F8D8D3, 02F8D8FC
4, xrefs: 02F8D9F7
.dat, xrefs: 02F8D0D7, 02F8D138, 02F8D1AE, 02F8D1D4, 02F8D28E, 02F8D308, 02F8D3CF, 02F8D441
srv_time, xrefs: 02F8CABB
wtm_c, xrefs: 02F8C956
local_time, xrefs: 02F8CACD
C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 02F8CC10, 02F8CCF3, 02F8D975, 02F8D98E
.sys, xrefs: 02F8D0CC
lid_file_upd, xrefs: 02F8CE6A
work_srv, xrefs: 02F8D607, 02F8D60F, 02F8D62C
wtm_w, xrefs: 02F8C96C
wtm_r, xrefs: 02F8C97F
\, xrefs: 02F8D3A7

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-1169304746
Opcode ID: 9f07289533b268396342f12cda8c3a9efa7860b7db67eed64cb1b14a4faf68c5
Instruction ID: 07371efc50ef4e254a3d1c2e12891c95d04c24fadcfee7f8b8277bc78b1c107b
Opcode Fuzzy Hash: 9f07289533b268396342f12cda8c3a9efa7860b7db67eed64cb1b14a4faf68c5
Instruction Fuzzy Hash: 77B28172D40209AFFB25BBA4DC85FEAFBB9EF04784F14046AE705A6190DB309955CF60

Function 02F89A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02F89A7F
SetErrorMode.KERNELBASE(00000003), ref: 02F89A83
SetUnhandledExceptionFilter.KERNEL32(02F86511), ref: 02F89A8A

Part of subcall function 02F8EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 02F8EC5E
Part of subcall function 02F8EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02F8EC72
Part of subcall function 02F8EC54: GetTickCount.KERNEL32 ref: 02F8EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02F89AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02F89ABA
GetCommandLineA.KERNEL32 ref: 02F89AFD
lstrlenA.KERNEL32(?), ref: 02F89B99
ExitProcess.KERNEL32 ref: 02F89C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02F89CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02F89D7A
lstrcatA.KERNEL32(?,?), ref: 02F89D8B
lstrcatA.KERNEL32(?,02F9070C), ref: 02F89D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02F89DED
DeleteFileA.KERNEL32(00000022), ref: 02F89E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02F89E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02F89EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02F89ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02F89F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02F89F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02F89F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02F89FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02F89FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02F89FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 02F8A038
lstrcatA.KERNEL32(00000022,02F90A34), ref: 02F8A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 02F8A072
lstrcatA.KERNEL32(00000022,02F90A34), ref: 02F8A08D
wsprintfA.USER32 ref: 02F8A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 02F8A0DE
lstrcatA.KERNEL32(00000022,?), ref: 02F8A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 02F8A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02F8A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 02F8A174
GetModuleFileNameA.KERNEL32(00000000), ref: 02F8A17B
GetDriveTypeA.KERNEL32(00000022), ref: 02F8A1B6
GetCommandLineA.KERNEL32 ref: 02F8A1E5

Part of subcall function 02F899D2: lstrcpyA.KERNEL32(?,?,00000100,02F922F8,00000000,?,02F89E9D,?,00000022,?,?,?,?,?,?,?), ref: 02F899DF
Part of subcall function 02F899D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02F89E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02F89A3C
Part of subcall function 02F899D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02F89E9D,?,00000022,?,?,?), ref: 02F89A52

lstrlenA.KERNEL32(?), ref: 02F8A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 02F8A3B7
GetLastError.KERNEL32 ref: 02F8A3ED
Sleep.KERNEL32(000003E8), ref: 02F8A400
DeleteFileA.KERNELBASE(02F933D8), ref: 02F8A407
CreateThread.KERNELBASE(00000000,00000000,02F8405E,00000000,00000000,00000000), ref: 02F8A42C
WSAStartup.WS2_32(00001010,?), ref: 02F8A43A
CreateThread.KERNELBASE(00000000,00000000,02F8877E,00000000,00000000,00000000), ref: 02F8A469
Sleep.KERNELBASE(00000BB8), ref: 02F8A48A
GetTickCount.KERNEL32 ref: 02F8A49F
GetTickCount.KERNEL32 ref: 02F8A4B7
Sleep.KERNELBASE(00001A90), ref: 02F8A4C3

Strings

\, xrefs: 02F89D0C
rpfcsqnj, xrefs: 02F8A389, 02F8A397
%X%08X, xrefs: 02F8A0B0
", xrefs: 02F8A189
", xrefs: 02F89EDB
C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 02F8A1D9
P, xrefs: 02F89DAA
", xrefs: 02F8A078
D, xrefs: 02F89F8E

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe$D$P$\$rpfcsqnj
API String ID: 2089075347-992914603
Opcode ID: 2339989a2fb1f6e8522a036e1e460af464519931808acec8d822838ac037cf48
Instruction ID: 06602d2e9960b8f82df157a8e27a178727ea28e0c123003f607c4e6f39a033d4
Opcode Fuzzy Hash: 2339989a2fb1f6e8522a036e1e460af464519931808acec8d822838ac037cf48
Instruction Fuzzy Hash: F1527872D4025DAFEF11ABA0CC49EEEF7BDEB04384F1444AAF705A6140EB719A548F51

Function 02F8199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 02F819B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02F81E9E), ref: 02F819BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02F819E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 02F819ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 02F819F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02F81E9E), ref: 02F81A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02F81E9E), ref: 02F81A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02F81E9E), ref: 02F81A36
GetAdaptersInfo.IPHLPAPI(00000000,02F81E9E,?,?,?,?,00000001,02F81E9E), ref: 02F81A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02F81E9E,?,?,?,?,00000001,02F81E9E), ref: 02F81A5A
GetAdaptersInfo.IPHLPAPI(00000000,02F81E9E,?,?,?,?,00000001,02F81E9E), ref: 02F81A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02F81E9E), ref: 02F81A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02F81E9E), ref: 02F81AA4

Strings

GetAdaptersInfo, xrefs: 02F819DC
Iphlpapi.dll, xrefs: 02F819B7
123.45.67.89, xrefs: 02F819A6
localcfg, xrefs: 02F819A3
GetBestInterface, xrefs: 02F819EF
GetIfEntry, xrefs: 02F819E4

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: e02e80ab44d740d01ad1c1487bd98f4be51c73c76c3f1acfd61758656b963344
Instruction ID: 6a299eeced50e36d231a823288d46bd693f1bb43f4ce4c4cd2621655bc0f2c27
Opcode Fuzzy Hash: e02e80ab44d740d01ad1c1487bd98f4be51c73c76c3f1acfd61758656b963344
Instruction Fuzzy Hash: 26315436D40119AFDF11AFE4DC898BFFBB9EF45685B14067DE605E2110DB304941CB60

Function 02F87A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02F87ABA
GetUserNameA.ADVAPI32(?,?), ref: 02F87ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,02F9070C,?,?,?), ref: 02F87B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02F87B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02F87B59
EqualSid.ADVAPI32(?,00000022), ref: 02F87B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02F87B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02F87B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02F87B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02F87BAB
LocalFree.KERNEL32(00000000), ref: 02F87BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02F87FC9,?,00000000), ref: 02F87BCE

Strings

C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 02F87CE2, 02F87D0F, 02F87D23, 02F87D24
D, xrefs: 02F87B0C

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe$D
API String ID: 2976863881-1637623080
Opcode ID: fd3c8a5ac2691e371f3945ebc5ee5f4cdeb9d1943c6723b035c13b219bb1a5fd
Instruction ID: 8fb67570ad9f2e893d6c55c6817b9f4049b659828a9a3cc396295b97c158c8a6
Opcode Fuzzy Hash: fd3c8a5ac2691e371f3945ebc5ee5f4cdeb9d1943c6723b035c13b219bb1a5fd
Instruction Fuzzy Hash: 1CA15F76D4021DABEF11AFA0CC88FEEFBB9FB45784F144469E606E2150EB318655CB60

Function 02F87809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02F8782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02F87866
GetLengthSid.ADVAPI32(?), ref: 02F87878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02F8789A
GetSecurityDescriptorOwner.ADVAPI32(?,02F87F63,?), ref: 02F878B8
EqualSid.ADVAPI32(?,02F87F63), ref: 02F878D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 02F878E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02F878F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02F87901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02F87910
LocalFree.KERNEL32(00000000), ref: 02F87917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02F87933
GetAce.ADVAPI32(?,00000000,?), ref: 02F87963
EqualSid.ADVAPI32(?,02F87F63), ref: 02F8798A
DeleteAce.ADVAPI32(?,00000000), ref: 02F879A3
EqualSid.ADVAPI32(?,02F87F63), ref: 02F879C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02F87A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02F87A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02F87A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02F87A79
LocalFree.KERNEL32(00000000), ref: 02F87A87

Strings

D, xrefs: 02F8785C

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: ef658d4c16e01330efa2f5f04488f27bb85ac112891b536341edf3be3b205a39
Instruction ID: e13959131db4381e6699d805775e50ab767db31f5e4d626c683d9ec7be15f223
Opcode Fuzzy Hash: ef658d4c16e01330efa2f5f04488f27bb85ac112891b536341edf3be3b205a39
Instruction Fuzzy Hash: 53813C76E0011DABDB21EFA4CD44FEEFBB8AF08784F244569E615E2150DB349651CF60

Function 02F88328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,02F90750,?,?,00000000,localcfg,00000000), ref: 02F883F3
RegQueryValueExA.KERNELBASE(02F90750,?,00000000,?,02F88893,?,?,?,00000000,00000103,02F90750,?,?,00000000,localcfg,00000000), ref: 02F88414
RegSetValueExA.KERNELBASE(02F90750,?,00000000,00000004,02F88893,00000004,?,?,00000000,00000103,02F90750,?,?,00000000,localcfg,00000000), ref: 02F88441
RegCloseKey.ADVAPI32(02F90750,?,?,00000000,00000103,02F90750,?,?,00000000,localcfg,00000000), ref: 02F8844A

Strings

C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 02F885C8, 02F885D5, 02F885E5
localcfg, xrefs: 02F88348

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe$localcfg
API String ID: 237177642-125568393
Opcode ID: 12573d20461403a8037ba58365f1181070a3ce0bb5aca93810795aa1ce27ee86
Instruction ID: f5527489aef7fe375418a5470e13ba204c2db34a578990dd88ab4b9ad1d9098a
Opcode Fuzzy Hash: 12573d20461403a8037ba58365f1181070a3ce0bb5aca93810795aa1ce27ee86
Instruction Fuzzy Hash: DBC19FB2D8010DBEEB11BBA49C85EEEFBBDAB043C4F540469F701A6140EB305A94CF61

Function 02F81D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02F81DC6
GetSystemInfo.KERNELBASE(?), ref: 02F81DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02F81E03
GetProcAddress.KERNEL32(00000000), ref: 02F81E0A
GetCurrentProcess.KERNEL32(?), ref: 02F81E1B
GetTickCount.KERNEL32 ref: 02F81FC9

Part of subcall function 02F81BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02F81C15

Strings

born_date, xrefs: 02F81EAD, 02F81ECC
kernel32, xrefs: 02F81DF7
hi_id, xrefs: 02F81F16, 02F81F1B, 02F81F33
flags_upd, xrefs: 02F81E3E, 02F81E43, 02F81E7C
net_type, xrefs: 02F81E87
lid_file_upd, xrefs: 02F81E25
IsWow64Process, xrefs: 02F81DF2
localcfg, xrefs: 02F81E2A, 02F81E31, 02F81E44, 02F81E7D, 02F81E8C, 02F81EB2, 02F81ED1, 02F81EE7, 02F81EFF, 02F81F1C, 02F81F34, 02F81F50, 02F81F70
work_srv, xrefs: 02F81E5E
start_srv, xrefs: 02F81E6C
loader_id, xrefs: 02F81F4B, 02F81F6B

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 8daf9e7d6b63bbd9e69b7e2b87479c12f93cddd9b4e9e851fe59e0438cd3834c
Instruction ID: 69add1567760a253e2acb38fd4d5064a4adc69a4d2e7348a92c0704e979a5071
Opcode Fuzzy Hash: 8daf9e7d6b63bbd9e69b7e2b87479c12f93cddd9b4e9e851fe59e0438cd3834c
Instruction Fuzzy Hash: 08517FB19043446FF730BB758C85F2BFAECEB44B88F040A1DF68A82242DB75A505CB61

Function 02F873FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 02F87472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F874F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F87528
___ascii_stricmp.LIBCMT ref: 02F8764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F876E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02F87706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F87717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F87745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 02F877EF

Part of subcall function 02F8F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02F922F8,000000C8,02F87150,?), ref: 02F8F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02F8778F
RegCloseKey.KERNELBASE(?), ref: 02F877E6

Strings

", xrefs: 02F87599

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 73266523f95b3a36ba7f8dc6d29236eadb301c767af173ff79f8add1438a9ecb
Instruction ID: e8d80fa41d8ef1dd4bec4fdcaf6705c1effe6895c7b9250ec808a036f5890242
Opcode Fuzzy Hash: 73266523f95b3a36ba7f8dc6d29236eadb301c767af173ff79f8add1438a9ecb
Instruction Fuzzy Hash: A5C1A276D04209ABEB11BBA4DC45FEEFBB9EF45790F2404A5E604E6190EB31DA44CF60

Function 02F8675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 02F8677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 02F8679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 02F867B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 02F867BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 02F867D3
ReadFile.KERNELBASE(000000FF,?,00000040,02F88244,00000000,?,74DF0F10,00000000), ref: 02F86807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02F8681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 02F8683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02F8685C
ReadFile.KERNEL32(000000FF,?,00000028,02F88244,00000000,?,74DF0F10,00000000), ref: 02F8688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 02F86906
ReadFile.KERNEL32(000000FF,?,00000000,02F88244,00000000,?,74DF0F10,00000000), ref: 02F8691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 02F86971

Part of subcall function 02F8EC2E: GetProcessHeap.KERNEL32(00000000,02F8EA27,00000000,02F8EA27,00000000), ref: 02F8EC41
Part of subcall function 02F8EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02F8EC48

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 11c445954a84456a3dae8a28fe08ad4ab4c2d1945ea090cc20b664c4e9406437
Instruction ID: 1c0f1323a832c11765c03f7320a2484b454835705b021626caad705961aadfce
Opcode Fuzzy Hash: 11c445954a84456a3dae8a28fe08ad4ab4c2d1945ea090cc20b664c4e9406437
Instruction Fuzzy Hash: BD71E471D0021DEFDB159FA4CC84AEEBBB9EF04394F10456AE615E6190E7309E92DF60

Function 02F8F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(02F8CA1D), ref: 02F8F34D
socket.WS2_32(00000002,00000001,00000000), ref: 02F8F367
closesocket.WS2_32(00000000), ref: 02F8F375

Strings

time_cfg, xrefs: 02F8F323

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 37810353c5d6fcbcbe5a365450f834e0f8fffe6833c669d74ce90a78e2c82be4
Instruction ID: ccaad3329fa353ff3ea1efdf2176f6449519b096eb2f6d5c555a73db5279207f
Opcode Fuzzy Hash: 37810353c5d6fcbcbe5a365450f834e0f8fffe6833c669d74ce90a78e2c82be4
Instruction Fuzzy Hash: B6317E7294011DAFDB10EFA5DC859EEBBBCFF88390F104666FA15D3140E7309A518BA0

Function 02F8405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02F84070
ExitProcess.KERNEL32 ref: 02F84121

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: d7b76470ed1f0aff9de5658d96c9ab5775a1c5fc96eb97137e6f8450376eca2a
Instruction ID: a42f84ccc14537e88406a83fe7fadc13e17c8cb3c187a191f9058724b7dfa7d4
Opcode Fuzzy Hash: d7b76470ed1f0aff9de5658d96c9ab5775a1c5fc96eb97137e6f8450376eca2a
Instruction Fuzzy Hash: B95182B1E40219BAEB21BBA08C45FBFFA7DEF11B94F000055F714B6190E7358A05DBA1

Function 02F82D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,02F82F01,?,02F820FF,02F92000), ref: 02F82D3A
LoadLibraryA.KERNEL32(?), ref: 02F82D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02F82D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02F82D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02F82D99
HeapAlloc.KERNEL32(00000000), ref: 02F82DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02F82DCB

Strings

DnsQuery_A, xrefs: 02F82D5B
dnsapi.dll, xrefs: 02F82D29

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: 2dc5c9387273c6a8da5a057adaa51cae5d36c85f3bc2cc6dcd74cd81d5d796ad
Instruction ID: 1793a5b2353d83abac22c2be5f57811953382fed46d40d412b30e25a4f0af177
Opcode Fuzzy Hash: 2dc5c9387273c6a8da5a057adaa51cae5d36c85f3bc2cc6dcd74cd81d5d796ad
Instruction Fuzzy Hash: 2F216276D40269ABDB21AF55DC44AAEFFB8FF08B90F104416FE06E7110E770A9958BD0

Function 02F880C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02F8815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,02F8A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02F88187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,02F8A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02F881BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 02F88210

Part of subcall function 02F8675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 02F8677E
Part of subcall function 02F8675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 02F8679A
Part of subcall function 02F8675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 02F867B0
Part of subcall function 02F8675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 02F867BF
Part of subcall function 02F8675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 02F867D3
Part of subcall function 02F8675C: ReadFile.KERNELBASE(000000FF,?,00000040,02F88244,00000000,?,74DF0F10,00000000), ref: 02F86807
Part of subcall function 02F8675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02F8681F
Part of subcall function 02F8675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 02F8683E
Part of subcall function 02F8675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 02F8685C

Part of subcall function 02F8EC2E: GetProcessHeap.KERNEL32(00000000,02F8EA27,00000000,02F8EA27,00000000), ref: 02F8EC41
Part of subcall function 02F8EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02F8EC48

Strings

C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe, xrefs: 02F88225, 02F8823A

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe
API String ID: 124786226-3712984543
Opcode ID: fabb5d897e3f2d893423c7451fcadb75c53627275484fba9e9e2989eaeaf0218
Instruction ID: 85c7848fc9f447376e125b6c5bea7481d1bc94e26fc25fea85207f177ab5217f
Opcode Fuzzy Hash: fabb5d897e3f2d893423c7451fcadb75c53627275484fba9e9e2989eaeaf0218
Instruction Fuzzy Hash: 0E415EB2D4110DBFEB11FBA49D80EBEF7AD9B047D4F54486AEB05A2100EB709A54CB61

Function 02F81AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02F81AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02F81AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02F81B20

Strings

Iphlpapi.dll, xrefs: 02F81ACC
GetAdaptersAddresses, xrefs: 02F81AE3

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: ce2e1f11b20c2437d40e2afcaaf84f76364f3e44ba1c5a21d105d8a8ae332863
Instruction ID: 8c9d502070db745f77a28f9258461fbe9327430fad56bd47d173803c4ee4b5c8
Opcode Fuzzy Hash: ce2e1f11b20c2437d40e2afcaaf84f76364f3e44ba1c5a21d105d8a8ae332863
Instruction Fuzzy Hash: 7611DA72E01138BFDB11ABA9DC848EFFBB9EB44B90F144259E209A3100E7304A41CB94

Function 02F8E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,02F8E5F2,00000000,00020119,02F8E5F2,02F922F8), ref: 02F8E3E6
RegQueryValueExA.ADVAPI32(02F8E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 02F8E44E
RegQueryValueExA.ADVAPI32(02F8E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 02F8E482
RegQueryValueExA.ADVAPI32(02F8E5F2,?,00000000,?,80000001,?), ref: 02F8E4CF
RegCloseKey.ADVAPI32(02F8E5F2,?,?,?,?,000000C8,000000E4), ref: 02F8E520

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 6db281d3b8511a4d3bd90606b9421fe7531652970753fb6ac540858b6eb3d0f2
Instruction ID: cd2d3d71f07cf80a1a56e7f511401a11fbab6c92fedeb365100f4729a5b1e01d
Opcode Fuzzy Hash: 6db281d3b8511a4d3bd90606b9421fe7531652970753fb6ac540858b6eb3d0f2
Instruction Fuzzy Hash: 1E4105B2D0021DAFEF11AFE4DC80DEEFBB9EB08384F544566FA10E6150E3319A158B60

Function 02F8F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 02F8F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 02F8F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 02F8F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 02F8F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02F8F2FD

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 0b2ef3ee0485c14fcabbb869271b0bf379a2692fe45d93c4c79055204371f7dc
Instruction ID: 53c69cc67d24ee81c71dcdc22305cb1953a55371a5d0ed6163fda5c1bee6b2a5
Opcode Fuzzy Hash: 0b2ef3ee0485c14fcabbb869271b0bf379a2692fe45d93c4c79055204371f7dc
Instruction Fuzzy Hash: FA11FBB1A40248BAEB11DF94CD41FAE7FBCEB44751F004066BB04EA1D0E6B19A44CB94

Function 02F81BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F81AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02F81AD4
Part of subcall function 02F81AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02F81AE9
Part of subcall function 02F81AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02F81B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02F81C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02F81C51

Strings

hi_id, xrefs: 02F81BE5
localcfg, xrefs: 02F81BE7

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 0573afa75497ec9fd8f5f0b1e4e17ee8bd42f301163f2b0371fb562628f7f73c
Instruction ID: 9d06c16096b10f4ff0d656e1b97b85190a8b3035dbc87bd076701152823b65ee
Opcode Fuzzy Hash: 0573afa75497ec9fd8f5f0b1e4e17ee8bd42f301163f2b0371fb562628f7f73c
Instruction Fuzzy Hash: C70180B6E0011CBBEB10EAE8CCC59EFFBBCAB45689F100579E706E2100D6309E4596A0

Function 02F81B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02F81AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02F81AD4
Part of subcall function 02F81AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02F81AE9
Part of subcall function 02F81AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02F81B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02F81BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02F81EFD,00000000,00000000,00000000,00000000), ref: 02F81BB8

Strings

localcfg, xrefs: 02F81B7B

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 12642dae80b4aa8a1911f63bccb2f2a736f57bb165c3a2a40956049fca639c9b
Instruction ID: 7a6a29603193d2e69f65a69cea78637c2fc87cd767f45c7179460c94e6571271
Opcode Fuzzy Hash: 12642dae80b4aa8a1911f63bccb2f2a736f57bb165c3a2a40956049fca639c9b
Instruction Fuzzy Hash: 80014FB7D0010CBFE701ABE9CC819EFFBBDAB48694F150565AB05E7150D5705E058AA0

Function 02F82684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 02F82693
gethostbyname.WS2_32(00000001), ref: 02F8269F

Strings

time_cfg, xrefs: 02F82684

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: eab4a9a401b8cef4771461f1bb8a8a978a89007792b992f346d4e760bfcc8a1e
Instruction ID: c57a992a387c4bac5f1be676fcd6c4d1c56762fc6db1ebae188352ebe1f26523
Opcode Fuzzy Hash: eab4a9a401b8cef4771461f1bb8a8a978a89007792b992f346d4e760bfcc8a1e
Instruction Fuzzy Hash: ECE01230E145519FDB50AB28F444BD9F7E5EF462B0F054585F954D7190DB30EC819B94

Function 02F8E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02F8DD05: GetTickCount.KERNEL32 ref: 02F8DD0F
Part of subcall function 02F8DD05: InterlockedExchange.KERNEL32(02F936B4,00000001), ref: 02F8DD44
Part of subcall function 02F8DD05: GetCurrentThreadId.KERNEL32 ref: 02F8DD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,02F8A445), ref: 02F8E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,74DF0F10,?,00000000,?,02F8A445), ref: 02F8E583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,02F8A445), ref: 02F8E5B2

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 0d5753cc6bde0285099862d008275b3ab6186e92cb43702d0b797f0eebe0df87
Instruction ID: ed1fe5abedbf14f0659e9bb9eb41a9b7da5a8057b9c642d28c59ce0761f2ca75
Opcode Fuzzy Hash: 0d5753cc6bde0285099862d008275b3ab6186e92cb43702d0b797f0eebe0df87
Instruction Fuzzy Hash: FB21A3B2A803057AF6217A219C45FABFA5DDF55BD0F000558BF0EA52D2EA51E9208AF1

Function 02F8877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 02F888A5

Part of subcall function 02F8F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02F8E342,00000000,75A8EA50,80000001,00000000,02F8E513,?,00000000,00000000,?,000000E4), ref: 02F8F089
Part of subcall function 02F8F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02F8E342,00000000,75A8EA50,80000001,00000000,02F8E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02F8F093

Strings

rresolv, xrefs: 02F887F6, 02F8885C
localcfg, xrefs: 02F887CA, 02F887CF, 02F887FB, 02F88835, 02F88861

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: ed330f2b009f59cfba90439b27b0c843ed3378112687d01609d6418ccdfee33c
Instruction ID: e32445d790690b832d8f14ee478b2812e4b1933e79aa961ba8a62f361158b90e
Opcode Fuzzy Hash: ed330f2b009f59cfba90439b27b0c843ed3378112687d01609d6418ccdfee33c
Instruction Fuzzy Hash: C021D932A883087EF724F7646C46F6EF69A9B51BE8FD00419FF04950C1EFA1558089B2

Function 02F84000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,02F922F8,02F842B6,00000000,00000001,02F922F8,00000000,?,02F898FD), ref: 02F84021
GetLastError.KERNEL32(?,02F898FD,00000001,00000100,02F922F8,02F8A3C7), ref: 02F8402C
Sleep.KERNEL32(000001F4,?,02F898FD,00000001,00000100,02F922F8,02F8A3C7), ref: 02F84046

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: fe1ec3ffdb609ba62e33f6dc10ad3ed900625682a0ed2f83c8319d22142bae24
Instruction ID: 45bb2d8efb8c1bdf35da17244bf4de6232645a3d8b0dc1bd0486304a12c1eb5f
Opcode Fuzzy Hash: fe1ec3ffdb609ba62e33f6dc10ad3ed900625682a0ed2f83c8319d22142bae24
Instruction Fuzzy Hash: BBF0A732A402066AD7312B34AC49B1BB265EB81FA8F264B28F3B5F20E0CB3044859B14

Function 02F8DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02F8DC19,?,00000104), ref: 02F8DB7F
lstrcpyA.KERNEL32(?,02F928F8), ref: 02F8DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 02F8DBC2

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: f3a99f93d0cb669d74f83faedfe69bc4ee5840c8c4da822703b196f18713725d
Instruction ID: d8a9f69ec783a35b260c08bd263a833be2de121daa868f8b3ff9b92cf435482c
Opcode Fuzzy Hash: f3a99f93d0cb669d74f83faedfe69bc4ee5840c8c4da822703b196f18713725d
Instruction Fuzzy Hash: 9FF09070940209ABEF119F64DC49FD97B69AF00788F104594BB51A40D0D7F2D555CB10

Function 02F8EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 02F8EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02F8EC72
GetTickCount.KERNEL32 ref: 02F8EC78

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 01f8710828d59f54fb9f1cbf70e41445e85458059cb66f2e11de851e676576c8
Instruction ID: ce284028a93f04760c1737e58d9ee1fbdf2fde8357ac6c6d02d26bd4d6e4cb87
Opcode Fuzzy Hash: 01f8710828d59f54fb9f1cbf70e41445e85458059cb66f2e11de851e676576c8
Instruction Fuzzy Hash: D1E09AF5C50108BFE705ABB0DC4AE6BB7BCEB08754F500A55BA11D6090DA709A148B60

Function 02F830B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02F830D8
gethostbyname.WS2_32(?), ref: 02F830E2

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 858e96215ae5733331576581f5ad166e38e6ce3463afb7fad23428bf3dc3a7e0
Instruction ID: 198f9656f8941b3ee3618df61187cdfbed1c304ee5f068b78e63a259bbefccd5
Opcode Fuzzy Hash: 858e96215ae5733331576581f5ad166e38e6ce3463afb7fad23428bf3dc3a7e0
Instruction Fuzzy Hash: 79E06D72D0011DABCB10ABA8EC89F9AB7ACBB04248F080461F905E3290EA34E5048BA0

Function 02F8EC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02F8EBA0: GetProcessHeap.KERNEL32(00000000,00000000,02F8EC0A,00000000,80000001,?,02F8DB55,7FFF0001), ref: 02F8EBAD
Part of subcall function 02F8EBA0: HeapSize.KERNEL32(00000000,?,02F8DB55,7FFF0001), ref: 02F8EBB4

GetProcessHeap.KERNEL32(00000000,02F8EA27,00000000,02F8EA27,00000000), ref: 02F8EC41
RtlFreeHeap.NTDLL(00000000), ref: 02F8EC48

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: 7ca5181055b88df9c30e218a12cc6b23b81838e196076ddbedd1abb1f9bf1ed4
Instruction ID: c0a0b9c14a9f9db06c2da4dd67babce11b659e3695552db13b31a3573ccdd682
Opcode Fuzzy Hash: 7ca5181055b88df9c30e218a12cc6b23b81838e196076ddbedd1abb1f9bf1ed4
Instruction Fuzzy Hash: 8FC01232D462346BD5513B50BC0DF9BFB589F46695F09080DF60566044CB6058808AE1

Function 02F8EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,02F8EBFE,7FFF0001,?,02F8DB55,7FFF0001), ref: 02F8EBD3
RtlAllocateHeap.NTDLL(00000000,?,02F8DB55,7FFF0001), ref: 02F8EBDA

Part of subcall function 02F8EB74: GetProcessHeap.KERNEL32(00000000,00000000,02F8EC28,00000000,?,02F8DB55,7FFF0001), ref: 02F8EB81
Part of subcall function 02F8EB74: HeapSize.KERNEL32(00000000,?,02F8DB55,7FFF0001), ref: 02F8EB88

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: 20c0afd023f5f787cc7868ffdf3b65be8c70ed9c6da6be788941880557071bd6
Instruction ID: 1e7359ee3fd6266a1cd6302d25d6ea365a6afb532f9fa0a296426317825a8138
Opcode Fuzzy Hash: 20c0afd023f5f787cc7868ffdf3b65be8c70ed9c6da6be788941880557071bd6
Instruction Fuzzy Hash: B8C0803254422067D60137E47C0CF9ABE94DF043E2F040408F605C1164CF3048908F95

Function 02F8F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,02F8CA44), ref: 02F8F476

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 1b1b8f5e59bf028453398eb07ba3d9ca1eb0e7f7ce7403a14d77066db837d121
Instruction ID: c25fc6b7701aa99478f1850499e4df62710cd8b029aa716f0c593e63a6b43a99
Opcode Fuzzy Hash: 1b1b8f5e59bf028453398eb07ba3d9ca1eb0e7f7ce7403a14d77066db837d121
Instruction Fuzzy Hash: 1FF0127360155EAF9B11AE59DD84CAB7BAEFB892907440622FB14D7110D631D8218B60

Function 02F81978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02F81992

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 1bbde9ed9b7fe731a64227946c4884e6a813b98397d2483f58918dcc126be824
Instruction ID: 6ec2e9d522fb674072066eab1975b68e89516370bb2c166d3d76564cf89091c0
Opcode Fuzzy Hash: 1bbde9ed9b7fe731a64227946c4884e6a813b98397d2483f58918dcc126be824
Instruction Fuzzy Hash: 87D012265486356A52113759BC0447FFB9CDF456E2751951BFD48C0150DB35C8428795

Function 02F8DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 02F8DDB5

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 89f9889e6c981487ae4e013733eeb3271893191c583252b3e7a941f60ca936f6
Instruction ID: 45bd115751a1839255fc6ed4b80b6a7b4a74d2f4a42809da45f1b0ea5297996b
Opcode Fuzzy Hash: 89f9889e6c981487ae4e013733eeb3271893191c583252b3e7a941f60ca936f6
Instruction Fuzzy Hash: 1BF08233A00202DBCB20EE349844656F3E4EF467E9F14483EE75AD22D0EB30D856CB11

Non-executed Functions

Function 02F8637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02F89816,EntryPoint), ref: 02F8638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02F89816,EntryPoint), ref: 02F863A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02F863CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02F863EB

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 40c01a4f020dc1512ca47a432d57eaae3c56e294026e1268fa4d4f546bad7e06
Instruction ID: d8158296489dee0e8c31c990c317e44ba98591a7676a102f9f54123504d55de9
Opcode Fuzzy Hash: 40c01a4f020dc1512ca47a432d57eaae3c56e294026e1268fa4d4f546bad7e06
Instruction Fuzzy Hash: D31191B2A00219BFEB219F65DC49F9B7BACEB047E4F014424FA14E6280DB71DC108AA0

Function 02F81000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02F81839,02F89646), ref: 02F81012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 02F810C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 02F810E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02F81101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02F81121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02F81140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02F81160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02F81180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 02F8119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 02F811BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 02F811DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 02F811FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 02F8121A

Strings

RtlLengthSid, xrefs: 02F81246
NtQueryInformationToken, xrefs: 02F81262
RtlAllocateAndInitializeSid, xrefs: 02F8120F
NtSetInformationToken, xrefs: 02F81175
NtOpenProcessToken, xrefs: 02F811D4
RtlInitUnicodeString, xrefs: 02F81135
NtDuplicateToken, xrefs: 02F811F3
NtClose, xrefs: 02F811B4
NtFilterToken, xrefs: 02F8122B
NtSetInformationThread, xrefs: 02F81155
NtTerminateProcess, xrefs: 02F810F6
RtlSetLastWin32Error, xrefs: 02F810D6
RtlExpandEnvironmentStrings_U, xrefs: 02F810BC
RtlNtStatusToDosError, xrefs: 02F81194
RtlFreeSid, xrefs: 02F81116
ntdll.dll, xrefs: 02F8100D

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 58f9745d484c4bc13920e36ce2a26a0744b2e5063add65e41f524c018c2505d3
Instruction ID: 5e20bfbc89f8a7a0b9485f9cd267466d6c7d4ac40d8ebb51d32e896d5b192b76
Opcode Fuzzy Hash: 58f9745d484c4bc13920e36ce2a26a0744b2e5063add65e41f524c018c2505d3
Instruction Fuzzy Hash: 4C51C971D82606AEFB31ABACAC60753F2EA63487E4F040B66DA26D21D0D770C4D2CF51

Function 02F8B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 02F8B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 02F8B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 02F8B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 02F8B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 02F8B31A
GetTimeZoneInformation.KERNEL32(?), ref: 02F8B329
wsprintfA.USER32 ref: 02F8B3B7

Strings

Oct, xrefs: 02F8B295
Sun, xrefs: 02F8B225
Jun, xrefs: 02F8B279
Nov, xrefs: 02F8B29C
Apr, xrefs: 02F8B26B
Jan, xrefs: 02F8B256
Sat, xrefs: 02F8B24F
Tue, xrefs: 02F8B233
Mar, xrefs: 02F8B264
May, xrefs: 02F8B272
Dec, xrefs: 02F8B2A3
Aug, xrefs: 02F8B287
Fri, xrefs: 02F8B248
Feb, xrefs: 02F8B25D
Wed, xrefs: 02F8B23A
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 02F8B3AF
Mon, xrefs: 02F8B22C
Thu, xrefs: 02F8B241
Sep, xrefs: 02F8B28E
Jul, xrefs: 02F8B280

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 44472ceda2c82e27dcf0769c9decd97c1b25bac5cbf88d34cdaaa1692315a0d1
Instruction ID: 45eed18a52b0744350eef879f9018612bf9a24b3a289380c1dc38240af6611bf
Opcode Fuzzy Hash: 44472ceda2c82e27dcf0769c9decd97c1b25bac5cbf88d34cdaaa1692315a0d1
Instruction Fuzzy Hash: 295127B2E0021DAAEF15DFD4D9849EFFBB9AF48388F10446DE711B6150DB344A89CB90

Function 02F86511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02F8654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 02F8655C
htonl.WS2_32(?), ref: 02F86578
htonl.WS2_32(?), ref: 02F86587
wsprintfA.USER32 ref: 02F8659B
wsprintfA.USER32 ref: 02F865DC
wsprintfA.USER32 ref: 02F86671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02F8668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02F86696
wsprintfA.USER32 ref: 02F866B0
wsprintfA.USER32 ref: 02F866E7
wsprintfA.USER32 ref: 02F866FF
wsprintfA.USER32 ref: 02F8671F
ExitProcess.KERNEL32 ref: 02F86755

Strings

ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 02F8666B
except_info, xrefs: 02F86728
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 02F865D6
plgs:, xrefs: 02F866AA
%d=%p, xrefs: 02F866F9
12:08:32, xrefs: 02F86535
va=%08X%08X uef=%p, xrefs: 02F86595
localcfg, xrefs: 02F8672D
Jan 13 2018, xrefs: 02F8653A
ver=%d date=%s %sc=%08x a=%p, xrefs: 02F86547

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 6b7e6309fa7027b648f0dea6d50fef70ae2883f504e831a26a52c91a497154ba
Instruction ID: 4a02b8be2480c0eca3c5d14852325d1f47bfe391894a5d6edcb1d0ae6ca1c3bd
Opcode Fuzzy Hash: 6b7e6309fa7027b648f0dea6d50fef70ae2883f504e831a26a52c91a497154ba
Instruction Fuzzy Hash: 37614B72A40208AFEF60AFA4DC45FEAB7F9FF08340F144469FA69D6161EB7199508F50

Function 02F8A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02F8A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 02F8A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 02F8A893
wsprintfA.USER32 ref: 02F8A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 02F8A8D2
wsprintfA.USER32 ref: 02F8A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 02F8A97C
wsprintfA.USER32 ref: 02F8A9B9

Strings

ESMTP, xrefs: 02F8AA38
Too small respons, xrefs: 02F8A9C9
ehlo %s, xrefs: 02F8A7F5
data, xrefs: 02F8A85E
helo %s, xrefs: 02F8A803
., xrefs: 02F8A8CA
AUTH LOGIN, xrefs: 02F8A80C
localcfg, xrefs: 02F8AB0B
Incorrect respons, xrefs: 02F8AB39
mail from:<%s>, xrefs: 02F8A848
Too big smtp respons (%d bytes), xrefs: 02F8A9B1
rcpt to:<%s>, xrefs: 02F8A855
Error sending command (sent = %d/%d), xrefs: 02F8A8A7, 02F8A8DA
quit, xrefs: 02F8A86C

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 97b328380978d1a1656619a2d6a3d0ccfc33a97bdef523cddbbba6aac5045d51
Instruction ID: ca34345b4dae70c9ff02229bd39c0eb0a5bbc2531988cacf12be1f22fd2edb39
Opcode Fuzzy Hash: 97b328380978d1a1656619a2d6a3d0ccfc33a97bdef523cddbbba6aac5045d51
Instruction Fuzzy Hash: BDA13D72E44309EAFF21BA54DC85FAEF76AEB007C8F140467FB01A6090DB319954CB55

Function 02F81280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02F8139A
lstrlenW.KERNEL32(-00000003), ref: 02F81571

Strings

, xrefs: 02F81462
PDu, xrefs: 02F8139A
%systemroot%\system32\cmd.exe, xrefs: 02F81316
<, xrefs: 02F81378
D, xrefs: 02F815C6
useless, xrefs: 02F8161E
@, xrefs: 02F81380
uac, xrefs: 02F81628
wusa.exe, xrefs: 02F81388

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 13f67dd500f1915b7aaffe2de811f7bd6ec8511c560ddbc1593ddc5744454c80
Instruction ID: 207759b10d4b1c7071f3bd3d8673c9b41490a298815125f08d72fc74f568f90e
Opcode Fuzzy Hash: 13f67dd500f1915b7aaffe2de811f7bd6ec8511c560ddbc1593ddc5744454c80
Instruction Fuzzy Hash: 92F17CB5A083459FD720EF64C888B6BF7E5FB88384F004A2DFA9A87250D7749845CF52

Function 02F82A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 02F82A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 02F82A86
socket.WS2_32(00000002,00000002,00000011), ref: 02F82AA0
htons.WS2_32(00000000), ref: 02F82ADB
select.WS2_32 ref: 02F82B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02F82B4A
htons.WS2_32(?), ref: 02F82B71
htons.WS2_32(?), ref: 02F82B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02F82BFB

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 462895248264568b36fd4fee18b59ea4a32207c875660186713154ac6878cf45
Instruction ID: decdd40180074d188a81abe01fb2f9308c2d89d589654800d0aa2e22ab36d611
Opcode Fuzzy Hash: 462895248264568b36fd4fee18b59ea4a32207c875660186713154ac6878cf45
Instruction Fuzzy Hash: 38619F729043499FD720AF65DC48B7AFBE8EB497E5F01080DFB4597140DBB4E8848BA1

Function 02F8704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 02F870C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 02F8719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 02F871B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 02F87208
RegCloseKey.ADVAPI32(74DF0F10), ref: 02F87291
___ascii_stricmp.LIBCMT ref: 02F872C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 02F872D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 02F87314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02F8738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 02F873D8

Part of subcall function 02F8F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02F922F8,000000C8,02F87150,?), ref: 02F8F1AD

Strings

", xrefs: 02F87227
, xrefs: 02F87194

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 3eaec8adb655c52bc53c3bf313e8f2fd5760c0b8738430bddc55b123c1cf0aaf
Instruction ID: 26acb0eb10aa5bcd38e4747f76c421dcd23ec351f2ac12fc3a708c2c87eee9a3
Opcode Fuzzy Hash: 3eaec8adb655c52bc53c3bf313e8f2fd5760c0b8738430bddc55b123c1cf0aaf
Instruction Fuzzy Hash: 3EB19176D44209AEEF15BFA4DC45BEEF7B9AF04384F200466F601E6090EB719A84CF61

Function 02F8AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02F8AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 02F8ADA6

Part of subcall function 02F8AD08: gethostname.WS2_32(?,00000080), ref: 02F8AD1C
Part of subcall function 02F8AD08: lstrlenA.KERNEL32(00000000), ref: 02F8AD60
Part of subcall function 02F8AD08: lstrlenA.KERNEL32(00000000), ref: 02F8AD69
Part of subcall function 02F8AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 02F8AD7F

Part of subcall function 02F830B5: gethostname.WS2_32(?,00000080), ref: 02F830D8
Part of subcall function 02F830B5: gethostbyname.WS2_32(?), ref: 02F830E2

wsprintfA.USER32 ref: 02F8AEA5

Part of subcall function 02F8A7A3: inet_ntoa.WS2_32(?), ref: 02F8A7A9

wsprintfA.USER32 ref: 02F8AE4F
wsprintfA.USER32 ref: 02F8AE5E

Part of subcall function 02F8EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 02F8EF92
Part of subcall function 02F8EF7C: lstrlenA.KERNEL32(?), ref: 02F8EF99
Part of subcall function 02F8EF7C: lstrlenA.KERNEL32(00000000), ref: 02F8EFA0

Strings

%OUTLOOK_HST, xrefs: 02F8AEC5
%OUTLOOK_MID, xrefs: 02F8AEAE
127.0.0.1, xrefs: 02F8ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 02F8AE9F
%OUTLOOK_BND_, xrefs: 02F8AE0F, 02F8AE14, 02F8AE57, 02F8AE76
%s%d, xrefs: 02F8AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 02F8AE49

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: a15df4a2cc9ecfbc5f3fc2b2b4c27785d500cd8ce370e9198690e63a225ec73b
Instruction ID: 431913a0c18e92ea0d370250d1c602287596a798be97b459c96ba86459b59026
Opcode Fuzzy Hash: a15df4a2cc9ecfbc5f3fc2b2b4c27785d500cd8ce370e9198690e63a225ec73b
Instruction Fuzzy Hash: A741EDB390024CABEF25BFA0DC45EEE7BADFB48384F14441AFA1592151EA71D554CF50

Function 02F82DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,02F82F0F,?,02F820FF,02F92000), ref: 02F82E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02F82F0F,?,02F820FF,02F92000), ref: 02F82E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02F82E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02F82F0F,?,02F820FF,02F92000), ref: 02F82E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02F82F0F,?,02F820FF,02F92000), ref: 02F82E4F
htons.WS2_32(00000035), ref: 02F82E88
inet_addr.WS2_32(?), ref: 02F82E93
gethostbyname.WS2_32(?), ref: 02F82EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02F82F0F,?,02F820FF,02F92000), ref: 02F82EE3
HeapFree.KERNEL32(00000000,?,00000000,02F82F0F,?,02F820FF,02F92000), ref: 02F82EE6

Strings

GetNetworkParams, xrefs: 02F82E28
iphlpapi.dll, xrefs: 02F82DFB, 02F82E00, 02F82E10

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 80cf21b1e7cd94129a5320e97a9d7923fdcd6f0ef8a06bab61a226863574122f
Instruction ID: b80597c811e805eee2a493c3e9ae193dbff594d1544ecf07303b27baf460c4af
Opcode Fuzzy Hash: 80cf21b1e7cd94129a5320e97a9d7923fdcd6f0ef8a06bab61a226863574122f
Instruction Fuzzy Hash: 3731C433E40249ABDF11ABB89844B6EF7B8AF047E5F140559EE14E7290DF30E5518B58

Function 02F89326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02F89DD7,?,00000022,?,?,00000000,00000001), ref: 02F89340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02F89DD7,?,00000022,?,?,00000000,00000001), ref: 02F8936E
GetModuleFileNameA.KERNEL32(00000000,?,02F89DD7,?,00000022,?,?,00000000,00000001), ref: 02F89375
wsprintfA.USER32 ref: 02F893CE
wsprintfA.USER32 ref: 02F8940C
wsprintfA.USER32 ref: 02F8948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02F894F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02F89526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02F89571

Strings

runas, xrefs: 02F89674

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 34e88dd2f516801f552f334fefe6b9cf2940272031be8fccf5625129fe1dda13
Instruction ID: 54bfc3a13fdfc4a08b2b42a27b5672dc922811e95a05e789be35bc9fa731d670
Opcode Fuzzy Hash: 34e88dd2f516801f552f334fefe6b9cf2940272031be8fccf5625129fe1dda13
Instruction Fuzzy Hash: 24A17FB294024CAFEB25AFA0CC45FEEBBADEB44780F10042AFB1596251D7B5D554CFA0

Function 02F8B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02F8B467

Part of subcall function 02F8EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 02F8EF92
Part of subcall function 02F8EF7C: lstrlenA.KERNEL32(?), ref: 02F8EF99
Part of subcall function 02F8EF7C: lstrlenA.KERNEL32(00000000), ref: 02F8EFA0

Strings

%TO_DOMAIN, xrefs: 02F8B44B
%TO_EMAIL, xrefs: 02F8B473
%FROM_DOMAIN, xrefs: 02F8B41E
%s@%s, xrefs: 02F8B461
%P5DATE, xrefs: 02F8B4F2
%TO_USER, xrefs: 02F8B488
%TO_HASH, xrefs: 02F8B4B0
%FROM_EMAIL, xrefs: 02F8B3E9
%DATE, xrefs: 02F8B4D2
%M5DATE, xrefs: 02F8B50F
%FROM_USER, xrefs: 02F8B431

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: d5a3a04b5cce19abb2f81837c82eb85c665e44696333190a3602cb382aa95741
Instruction ID: 858db358389dc77b5f89f6413e85b6663c114352ac910615bdf465f28de537a1
Opcode Fuzzy Hash: d5a3a04b5cce19abb2f81837c82eb85c665e44696333190a3602cb382aa95741
Instruction Fuzzy Hash: FD410CB25401197EFF01BAA4DCC1DBFBB6DEF496D8F140419FB05B2100DA75AA298BA1

Function 02F82011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F82078
GetTickCount.KERNEL32 ref: 02F820D4
GetTickCount.KERNEL32 ref: 02F820DB
GetTickCount.KERNEL32 ref: 02F8212B
GetTickCount.KERNEL32 ref: 02F82132
GetTickCount.KERNEL32 ref: 02F82142

Part of subcall function 02F8F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02F8E342,00000000,75A8EA50,80000001,00000000,02F8E513,?,00000000,00000000,?,000000E4), ref: 02F8F089
Part of subcall function 02F8F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02F8E342,00000000,75A8EA50,80000001,00000000,02F8E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02F8F093

Part of subcall function 02F8E854: lstrcpyA.KERNEL32(00000001,?,?,02F8D8DF,00000001,localcfg,except_info,00100000,02F90264), ref: 02F8E88B
Part of subcall function 02F8E854: lstrlenA.KERNEL32(00000001,?,02F8D8DF,00000001,localcfg,except_info,00100000,02F90264), ref: 02F8E899

Part of subcall function 02F81C5F: wsprintfA.USER32 ref: 02F81CE1

Strings

rbl_bl, xrefs: 02F82181
net_type, xrefs: 02F821DF
localcfg, xrefs: 02F82070, 02F82160, 02F82186, 02F82194, 02F821E4
rbl_ip, xrefs: 02F8218F

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 2ce43c99b4c9e4c9e15a55504f6dbd50a02c63e481e600e617970526d412d518
Instruction ID: 0d03890d81f99ec8626617cb46018c34adabe0c3ecad5f511cb2bde6140033ec
Opcode Fuzzy Hash: 2ce43c99b4c9e4c9e15a55504f6dbd50a02c63e481e600e617970526d412d518
Instruction Fuzzy Hash: E8512271E853896EF728FF35ED45B66FBD5AB00BC4F10091EEF0586190DBB0A1A8CA10

Function 02F8C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02F8A4C7: GetTickCount.KERNEL32 ref: 02F8A4D1
Part of subcall function 02F8A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 02F8A4FA

GetTickCount.KERNEL32 ref: 02F8C31F
GetTickCount.KERNEL32 ref: 02F8C32B
GetTickCount.KERNEL32 ref: 02F8C363
GetTickCount.KERNEL32 ref: 02F8C378
GetTickCount.KERNEL32 ref: 02F8C44D
InterlockedIncrement.KERNEL32(02F8C4E4), ref: 02F8C4AE
CreateThread.KERNEL32(00000000,00000000,02F8B535,00000000,?,02F8C4E0), ref: 02F8C4C1
CloseHandle.KERNEL32(00000000,?,02F8C4E0,02F93588,02F88810), ref: 02F8C4CC

Strings

localcfg, xrefs: 02F8C2DD

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 9c47c8f1d7228b2f6f81867e053239e60130fbd8068a73087c2e61a1726b82a0
Instruction ID: 02d9a13f19119488c218f60fc04f9bb610a0e171a06f34a6e923d3b3548000a6
Opcode Fuzzy Hash: 9c47c8f1d7228b2f6f81867e053239e60130fbd8068a73087c2e61a1726b82a0
Instruction Fuzzy Hash: 40515CB1A00B418FD728AF69C68452AFBE9FB48344B505D3ED28BC7A90D774F845CB24

Function 02F8BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02F8BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02F8BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02F8BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02F8BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02F8BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02F8BF94

Strings

smtp_ban, xrefs: 02F8BE55, 02F8BF77
smtp_retr, xrefs: 02F8BE61, 02F8BF8C
smtp_herr, xrefs: 02F8BE46, 02F8BF62

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 3ca7124215e297464fd0e693b88d8ec0a3cd6c0e48e07a7f21135ee680beccff
Instruction ID: 7f3582cea3342ece390fbffad09c39b39af5ef39644bb41b40747e85bdce5db7
Opcode Fuzzy Hash: 3ca7124215e297464fd0e693b88d8ec0a3cd6c0e48e07a7f21135ee680beccff
Instruction Fuzzy Hash: CC515272E0061AAFEF11ABA4D944B5EFBA9AF053CCF044469EA46DB211D730E945CF90

Function 02F86A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,02F89A60,?,?,02F89E9D), ref: 02F86A7D
GetDiskFreeSpaceA.KERNEL32(02F89E9D,02F89A60,?,?,?,02F922F8,?,?,?,02F89A60,?,?,02F89E9D), ref: 02F86ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02F89A60,?,?,02F89E9D), ref: 02F86B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02F89A60,?,?,02F89E9D), ref: 02F86B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02F89A60,?,?,02F89E9D), ref: 02F86B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02F89A60,?,?,02F89E9D), ref: 02F86B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02F89A60,?,?,02F89E9D), ref: 02F86B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02F89A60,?,?,02F89E9D), ref: 02F86B80
GetLastError.KERNEL32(?,?,?,02F89A60,?,?,02F89E9D,?,?,?,?,?,02F89E9D,?,00000022,?), ref: 02F86B96

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: cf0a9b07d5806b982926af7d5c3e7b82d68c1e41d14fd1af8e2e69b003b5d61a
Instruction ID: 637a7664fa269c93ee52cd06d825bd8963aaa638241ba11b33960cc34b827a39
Opcode Fuzzy Hash: cf0a9b07d5806b982926af7d5c3e7b82d68c1e41d14fd1af8e2e69b003b5d61a
Instruction Fuzzy Hash: 69319FB2E0014DBFDB01AFA48C44A9EFB7DEF44398F14486AE751E3251DB3095A58F61

Function 02F86F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,02F8D7C3), ref: 02F86F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,02F8D7C3), ref: 02F86FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02F86FE8
LocalFree.KERNEL32(00000120), ref: 02F8701F
wsprintfA.USER32 ref: 02F87036

Strings

|, xrefs: 02F86FB3
/%d, xrefs: 02F87030

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 865dc5863f3a7e43d723f936943437e50b78ceedc18dcea22977aee42d7d6960
Instruction ID: acd1363264e69205b3ac730bbe717ab9f3d614941aedb7f6168fec7c88325e59
Opcode Fuzzy Hash: 865dc5863f3a7e43d723f936943437e50b78ceedc18dcea22977aee42d7d6960
Instruction Fuzzy Hash: 40311A76A00108AFDB01EFA8DC48BDABBBCEF04394F148156FA59DB100EB35D6088F94

Function 02F86CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,02F922F8,000000E4,02F86DDC,000000C8), ref: 02F86CE7
GetProcAddress.KERNEL32(00000000), ref: 02F86CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02F86D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02F86D2B

Strings

kernel32, xrefs: 02F86CE2
GetSystemWow64DirectoryA, xrefs: 02F86CDD
C:\Windows\SysWOW64\, xrefs: 02F86CC9, 02F86CD1, 02F86CFE, 02F86D05, 02F86D13, 02F86D1E, 02F86D2A, 02F86D42, 02F86D5F, 02F86D85

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 4e56191c20a093e3747dae2e81344318ce6a57865f9bb953c9d3985771b21987
Instruction ID: dbf6d23e44e8644bc802409b351fce588e78fecc2859772ff6f2ed6b98825595
Opcode Fuzzy Hash: 4e56191c20a093e3747dae2e81344318ce6a57865f9bb953c9d3985771b21987
Instruction Fuzzy Hash: D221F663EC924879FB2177229CCCF67FE8D8B427C4F080448FF05D6181EB9595858AB5

Function 02F8977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02F89947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,02F922F8), ref: 02F897B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,02F922F8), ref: 02F897EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,02F922F8), ref: 02F897F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,02F922F8), ref: 02F89831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,02F922F8), ref: 02F8984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,02F922F8), ref: 02F8985B

Strings

D, xrefs: 02F897A9

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 6b69fd307d46b40501819e145533994de026d2f70dd3c99ccb323d6b73958853
Instruction ID: 4c4c0b4a2a4d72394b8e8240f95381efbf0d1abe06f07355c4ad48ccb07c9963
Opcode Fuzzy Hash: 6b69fd307d46b40501819e145533994de026d2f70dd3c99ccb323d6b73958853
Instruction Fuzzy Hash: 39213D72D4111DBBEB21AFA1DC49FEFBB7CEF04694F400465BA19E1150EB709654CEA0

Function 02F8E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02F8DD05: GetTickCount.KERNEL32 ref: 02F8DD0F
Part of subcall function 02F8DD05: InterlockedExchange.KERNEL32(02F936B4,00000001), ref: 02F8DD44
Part of subcall function 02F8DD05: GetCurrentThreadId.KERNEL32 ref: 02F8DD53

Part of subcall function 02F8DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 02F8DDB5

lstrcpynA.KERNEL32(?,02F81E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,02F8EAAA,?,?), ref: 02F8E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,02F8EAAA,?,?,00000001,?,02F81E84,?), ref: 02F8E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,02F8EAAA,?,?,00000001,?,02F81E84,?,0000000A), ref: 02F8E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,02F8EAAA,?,?,00000001,?,02F81E84,?), ref: 02F8E94F

Strings

flags_upd, xrefs: 02F8E8A7
localcfg, xrefs: 02F8E8AB

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: b395180859477e34637be8ff0ac7e1e3381f255c12966fe24995530165ddf9d9
Instruction ID: e308fbb38c3340a0caa0a20acdf4b18a4d8cf7a67364f39cdbf960104039983f
Opcode Fuzzy Hash: b395180859477e34637be8ff0ac7e1e3381f255c12966fe24995530165ddf9d9
Instruction Fuzzy Hash: F9511D72D0020AAFCF11EFA8CD849AEFBF9BF48344F14456AE505A7250E775EA158F60

Function 02F86BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02F86BB2

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 8b5084e6c69c78513d40a09843e6c685d6d6dc3db52cf080410d22ca2f3dd313
Instruction ID: eea9439e6980b9e3e0453b147d6581b43804034ba08349c10073acb973566667
Opcode Fuzzy Hash: 8b5084e6c69c78513d40a09843e6c685d6d6dc3db52cf080410d22ca2f3dd313
Instruction Fuzzy Hash: 19218176A04119FFDB116B61ED48D9FFA6DDB067E5B104819F702E1050EB319A10D774

Function 02F89064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,02F922F8), ref: 02F8907B
wsprintfA.USER32 ref: 02F890E9
CreateFileA.KERNEL32(02F922F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02F8910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02F89122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02F8912D
CloseHandle.KERNEL32(00000000), ref: 02F89134

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: c480058017c0cb41a973902ee90adb7d54104bd262d0081f8915e74112c18c2f
Instruction ID: 5dfc1c3fb1c7ca538c73f5945ee8c47422a461c71f3762f53f8cf728fd752d05
Opcode Fuzzy Hash: c480058017c0cb41a973902ee90adb7d54104bd262d0081f8915e74112c18c2f
Instruction Fuzzy Hash: D91187F2B401187BF7257762DC09EAFB66FDFC5B80F008469BB0AA5150EA704A118A64

Function 02F8DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F8DD0F
GetCurrentThreadId.KERNEL32 ref: 02F8DD20
GetTickCount.KERNEL32 ref: 02F8DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,02F8E538,?,74DF0F10,?,00000000,?,02F8A445), ref: 02F8DD3B
InterlockedExchange.KERNEL32(02F936B4,00000001), ref: 02F8DD44
GetCurrentThreadId.KERNEL32 ref: 02F8DD53

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 171edbfd0592e2c2a44d438e4217ad17020ac10dfc0175e157a391d4318a1332
Instruction ID: eba318cf79f708b74f414a04c04a676b89024c90e1389ae6eaf50aa55a7728a7
Opcode Fuzzy Hash: 171edbfd0592e2c2a44d438e4217ad17020ac10dfc0175e157a391d4318a1332
Instruction Fuzzy Hash: 6AF0547398810C9BDB806B75A884F29F775EB457D1F000859E70AC2191DB205465CF62

Function 02F8AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02F8AD1C
lstrlenA.KERNEL32(00000000), ref: 02F8AD60
lstrlenA.KERNEL32(00000000), ref: 02F8AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 02F8AD7F

Strings

LocalHost, xrefs: 02F8AD79

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 1130be1717fae8a9cac19a8fcd45615588c62f1b41ca1a5efd5733f46c67f6d7
Instruction ID: 96be63927a6bedabdf982723893f9e5de7c2a44affc974794e8083c1f30d12fa
Opcode Fuzzy Hash: 1130be1717fae8a9cac19a8fcd45615588c62f1b41ca1a5efd5733f46c67f6d7
Instruction Fuzzy Hash: 12014523C841895DDF312A388844BB4FF66EB867CAF00105BEAC2CB111FF64808387A2

Function 02F84BD1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F84BDD
GetTickCount.KERNEL32 ref: 02F84BEC
Sleep.KERNEL32(00000000,?,%FROM_EMAIL,02F85D02,00000000,?,02F8B85C,?,00000080,?,00000000,00000000,?,%FROM_EMAIL), ref: 02F84BF9
InterlockedExchange.KERNEL32(0342C0D0,00000001), ref: 02F84C02

Strings

%FROM_EMAIL, xrefs: 02F84BD1

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID: %FROM_EMAIL
API String ID: 2207858713-2903620461
Opcode ID: c5995815254db0c2e6498d3a0e7fdc4a6c5e62c21ffe0549f369cb047f05a9b5
Instruction ID: c843bf343933e381f48aca289162aab945472c1514fea00fe5ac598a38554b57
Opcode Fuzzy Hash: c5995815254db0c2e6498d3a0e7fdc4a6c5e62c21ffe0549f369cb047f05a9b5
Instruction Fuzzy Hash: 82E0CD3778121957CB1037B65C84F56F79CEB457E1F060476F709D2150CE56985141B1

Function 02F84280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02F898FD,00000001,00000100,02F922F8,02F8A3C7), ref: 02F84290
CloseHandle.KERNEL32(02F8A3C7), ref: 02F843AB
CloseHandle.KERNEL32(00000001), ref: 02F843AE

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: c7ee0743c493decf7e7f1fd0a085db7d487515eed5ea293f4aaf88a10d53f9ca
Instruction ID: 59be64b3548af179ca0ac0d32e0760c866976486c8f1c2bc2feda24b117185aa
Opcode Fuzzy Hash: c7ee0743c493decf7e7f1fd0a085db7d487515eed5ea293f4aaf88a10d53f9ca
Instruction Fuzzy Hash: 5B4188B2D0020ABADB21ABA1DD85FAFFBB9EF407A4F104555F614A2190DB348650DBA0

Function 02F86069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,02F864CF,00000000), ref: 02F8609C
LoadLibraryA.KERNEL32(?,?,02F864CF,00000000), ref: 02F860C3
GetProcAddress.KERNEL32(?,00000014), ref: 02F8614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02F8619E

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 678a882449af3fd548612e50af8c8e502ae19b52d63711b2939d195d8e8b4355
Instruction ID: c51b1630cf7249dccdac4a51d1ac4921a3b77668b28d7386450723408b86e2c4
Opcode Fuzzy Hash: 678a882449af3fd548612e50af8c8e502ae19b52d63711b2939d195d8e8b4355
Instruction Fuzzy Hash: 9A414D72F00509AFEB14EF54C884B79F7B9EF04B98F148169EA15D7292DB30E954CB90

Function 02F82923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4262d63785f0dbfa2282db2d229e43f41f386e3eea1dc4e27b23ef58347e9901
Instruction ID: 88ce00e4a0988b57f1dda77b1219bb87daeb6517e34ffba4935ffedfe3b38bf4
Opcode Fuzzy Hash: 4262d63785f0dbfa2282db2d229e43f41f386e3eea1dc4e27b23ef58347e9901
Instruction Fuzzy Hash: D431A072A00208ABDB20AFA9CC81BBEF7F4FF48781F104456EA04E6241E374E641CB54

Function 02F826FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F8272E
htons.WS2_32(00000001), ref: 02F82752
htons.WS2_32(0000000F), ref: 02F827D5
htons.WS2_32(00000001), ref: 02F827E3
sendto.WS2_32(?,02F92BF8,00000009,00000000,00000010,00000010), ref: 02F82802

Part of subcall function 02F8EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02F8EBFE,7FFF0001,?,02F8DB55,7FFF0001), ref: 02F8EBD3
Part of subcall function 02F8EBCC: RtlAllocateHeap.NTDLL(00000000,?,02F8DB55,7FFF0001), ref: 02F8EBDA

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 23359f1a2b51d0245bfa4987dd006fbbe55813947ebf74708b46f560ca181785
Instruction ID: fc14bb0e5663e93ae692fecdcd2f20391a697b6a811ac598a1c16adfdaed7228
Opcode Fuzzy Hash: 23359f1a2b51d0245bfa4987dd006fbbe55813947ebf74708b46f560ca181785
Instruction Fuzzy Hash: 75315B34A803CEAFD710AF76D880AA9F7A0EF19398B19445DED558B312D732E452CB50

Function 02F89145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,02F922F8), ref: 02F8915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02F89166
CharToOemA.USER32(?,?), ref: 02F89174
wsprintfA.USER32 ref: 02F891A9

Part of subcall function 02F89064: GetTempPathA.KERNEL32(00000400,?,00000000,02F922F8), ref: 02F8907B
Part of subcall function 02F89064: wsprintfA.USER32 ref: 02F890E9
Part of subcall function 02F89064: CreateFileA.KERNEL32(02F922F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02F8910E
Part of subcall function 02F89064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02F89122
Part of subcall function 02F89064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02F8912D
Part of subcall function 02F89064: CloseHandle.KERNEL32(00000000), ref: 02F89134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02F891E1

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 808ac88808e30a810002f5ae70dcef2b257585b55a646a7a858f4c22913c7451
Instruction ID: 8d196f2c0f1dd100e792ba032bad4be2a5fec0c3e960760278830dc869a1e059
Opcode Fuzzy Hash: 808ac88808e30a810002f5ae70dcef2b257585b55a646a7a858f4c22913c7451
Instruction Fuzzy Hash: CA0180F78401187BEA21A7619D49FEFB77CDB85B41F000096BB09E2040DAB096848F70

Function 02F82419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02F82491,?,?,?,02F8E844,-00000030,?,?,?,00000001), ref: 02F82429
lstrlenA.KERNEL32(?,?,02F82491,?,?,?,02F8E844,-00000030,?,?,?,00000001,02F81E3D,00000001,localcfg,lid_file_upd), ref: 02F8243E
lstrcmpiA.KERNEL32(?,?), ref: 02F82452
lstrlenA.KERNEL32(?,?,02F82491,?,?,?,02F8E844,-00000030,?,?,?,00000001,02F81E3D,00000001,localcfg,lid_file_upd), ref: 02F82467

Strings

localcfg, xrefs: 02F8241F

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 6d543e9f7955b7f49c44ac3e8c89f9bd2bf6abaae981d06f2c75600ea4f45ed6
Instruction ID: f68713c04ed254cea40c77790455ac80ef47de5bc768f14b1476e0bcbe6b9406
Opcode Fuzzy Hash: 6d543e9f7955b7f49c44ac3e8c89f9bd2bf6abaae981d06f2c75600ea4f45ed6
Instruction Fuzzy Hash: 67011A32A0025CEFCF11EF69CD849DEBBA9EF44394B01C429ED5997211E330EE508AA0

Function 02F81C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02F81CE1
wsprintfA.USER32 ref: 02F81D6B

Strings

%u.%u.%u.%u.%s, xrefs: 02F81CDB, 02F81D65
localcfg, xrefs: 02F81C70

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 75b2718f8b25be4b4ac458eca6438f042227d36160a56fcb00beffbf41ef11e5
Instruction ID: fa768b0ab4c1e9ef78a210072fa1ae9bff8884d4f050c188b4f2bccc18008fc5
Opcode Fuzzy Hash: 75b2718f8b25be4b4ac458eca6438f042227d36160a56fcb00beffbf41ef11e5
Instruction Fuzzy Hash: 0B418A729042989FDF21EF798C44BEEBBE99F49350F240156FAA5D3141E634EA05CFA0

Function 02F8E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02F8DD05: GetTickCount.KERNEL32 ref: 02F8DD0F
Part of subcall function 02F8DD05: InterlockedExchange.KERNEL32(02F936B4,00000001), ref: 02F8DD44
Part of subcall function 02F8DD05: GetCurrentThreadId.KERNEL32 ref: 02F8DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,02F85EC1), ref: 02F8E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,02F85EC1), ref: 02F8E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,74DF0F10,00000000,?,02F85EC1), ref: 02F8E722

Strings

89ABCDEF, xrefs: 02F8E721

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 2c27bbb2946ac2324a8acd7cdee371cbd89718e1edc2900ef43c42f8a24fb7ed
Instruction ID: a7f9930f78c6d50f7de865e1781715e0e16b63486cc5d9aadbbfe66231eb6ce4
Opcode Fuzzy Hash: 2c27bbb2946ac2324a8acd7cdee371cbd89718e1edc2900ef43c42f8a24fb7ed
Instruction Fuzzy Hash: B031AF32E00709EBDF31AF64D88476AB7E4AB01794F10482AFB5687551E770E884CF81

Function 02F8E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02F8E2A3,00000000,00000000,00000000,00020106,00000000,02F8E2A3,00000000,000000E4), ref: 02F8E0B2
RegSetValueExA.ADVAPI32(02F8E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,02F922F8), ref: 02F8E127
RegDeleteValueA.ADVAPI32(02F8E2A3,?,?,?,?,?,000000C8,02F922F8), ref: 02F8E158
RegCloseKey.ADVAPI32(02F8E2A3,?,?,?,?,000000C8,02F922F8,?,?,?,?,?,?,?,?,02F8E2A3), ref: 02F8E161

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 9a1a220b306895a1590854d241caea1281f0b22ef3e727fc641ebd71f391253b
Instruction ID: 34f586fc5c4befabf4acbddc103895529a4881347e9bf40ef00d2ee0975e5134
Opcode Fuzzy Hash: 9a1a220b306895a1590854d241caea1281f0b22ef3e727fc641ebd71f391253b
Instruction Fuzzy Hash: 56212172E40219BBDF20AEA4DC89EEEBF79EF05B90F004065FA05A6150D6718A54DB90

Function 02F83F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,02F8A3C7,00000000,00000000,000007D0,00000001), ref: 02F83FB8
GetLastError.KERNEL32 ref: 02F83FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02F83FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02F83FE6

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 0faf2255eec0843a3f984e4cbeb7f4cf2dc7cd240248843a6ae22eeeadd53a2f
Instruction ID: 663594f297a7eaca56a99c1c5e16183eee3da50c26fce25b9c941aa9d51da2a4
Opcode Fuzzy Hash: 0faf2255eec0843a3f984e4cbeb7f4cf2dc7cd240248843a6ae22eeeadd53a2f
Instruction Fuzzy Hash: 9801E97291011AABDF11EF94D945BEEBB7CEF04795F004455FA12E2060DB70DA64CBB1

Function 02F83F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,02F8A3C7,00000000,00000000,000007D0,00000001), ref: 02F83F44
GetLastError.KERNEL32 ref: 02F83F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02F83F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02F83F72

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 5d47be58eb9c38d9efb5daaa008bb4483b4303af09a9a3895cdfe7c068316568
Instruction ID: bbdf48bf74da4c6045b43d755c36f58fa4926cb910058bd73af955f3a6b6ad2f
Opcode Fuzzy Hash: 5d47be58eb9c38d9efb5daaa008bb4483b4303af09a9a3895cdfe7c068316568
Instruction Fuzzy Hash: FE01D372A11119ABDB05EF90D984BEEBBBCEF04795F104469FA01E2060D7349A249BA2

Function 02F8A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F8A4D1
GetTickCount.KERNEL32 ref: 02F8A4E4
Sleep.KERNEL32(00000000,?,02F8C2E9,02F8C4E0,00000000,localcfg,?,02F8C4E0,02F93588,02F88810), ref: 02F8A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 02F8A4FA

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 26e5e92318647f51f4c8fdceb3e7bfbfc6d2f6b52013b2ace0f0db678dd63878
Instruction ID: 583b8e762b1f9fe2093f2694055b4b29cbe7b5c98d48a796cee36cacf343f0cd
Opcode Fuzzy Hash: 26e5e92318647f51f4c8fdceb3e7bfbfc6d2f6b52013b2ace0f0db678dd63878
Instruction Fuzzy Hash: 19E0263364020857CE0027A5AD84F6AF388EB49BE1F010426FB04D3240CA1AA86181B2

Function 02F84E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F84E9E
GetTickCount.KERNEL32 ref: 02F84EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02F84EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02F84EC3

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 62237ee25088805aaa667ca2bf7689e9d7e9ea8a4519274d123723725084d800
Instruction ID: 7f8eb499616163f8c5813f0f676d9195bf28398aab7ff7c283bc391bc11d9e87
Opcode Fuzzy Hash: 62237ee25088805aaa667ca2bf7689e9d7e9ea8a4519274d123723725084d800
Instruction Fuzzy Hash: 67E0863374121957D71077B9AC84F57F6499B457E1F010935E709D2180DA56986245B1

Function 02F830FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F83103
GetTickCount.KERNEL32 ref: 02F8310F
Sleep.KERNEL32(00000000), ref: 02F8311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02F83128

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1d77dc6898b834e7d2993fafb3cb0826dafde5d8bba0573c1631364340e19d58
Instruction ID: 3dd52e5550187971c42e93bb0b0b43dc922114f7ad56d7a400b6a890ef4ec708
Opcode Fuzzy Hash: 1d77dc6898b834e7d2993fafb3cb0826dafde5d8bba0573c1631364340e19d58
Instruction Fuzzy Hash: 60E0C232F40219ABEF007B75AD44B69FA5ADF84FE1F010879F305D20B0CA504C208A71

Function 02F88CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F88D02
GetTickCount.KERNEL32 ref: 02F88DA1

Strings

localcfg, xrefs: 02F88D19

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 286cf8b4a86f14e7fc0cae9a9b68505696e9e56a7c8866add34837a247340184
Instruction ID: 5de40a9824e8da7eda147b8070da1a907d2b63f44862d44c5b2368776ad82793
Opcode Fuzzy Hash: 286cf8b4a86f14e7fc0cae9a9b68505696e9e56a7c8866add34837a247340184
Instruction Fuzzy Hash: 9E21D233E1011DAFCB14AF64C891A5AFBBAEF203D4BA5059AD602D7101EB31E950CB50

Function 02F8BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02F8BFD0
wsprintfA.USER32 ref: 02F8C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 02F8C057

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: f588e25a443c124b32c12d8e14919f61ff6cc3660f7d562263284b64743ff1ab
Instruction ID: 2d6c333c48ddcaa7467e8be85b7da95569b32304269f9bc007e19678aeaaebab
Opcode Fuzzy Hash: f588e25a443c124b32c12d8e14919f61ff6cc3660f7d562263284b64743ff1ab
Instruction Fuzzy Hash: 7E119772500100FFDB429BA9CD44E567FA6FF88358B34819CF6188E126D633D863EB50

Function 02F838F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02F830FA: GetTickCount.KERNEL32 ref: 02F83103
Part of subcall function 02F830FA: InterlockedExchange.KERNEL32(?,00000001), ref: 02F83128

GetCurrentThreadId.KERNEL32 ref: 02F83929
GetCurrentThreadId.KERNEL32 ref: 02F83939

Strings

%FROM_EMAIL, xrefs: 02F83913

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 62668477f66c1fc705c690e73ae063ea79f1ef557d9807a01b50c5be8b7f8340
Instruction ID: 5ac2689987c1c74c2948394d86c9fd97dcc2f6b4920d8022bcf91dce86762e9e
Opcode Fuzzy Hash: 62668477f66c1fc705c690e73ae063ea79f1ef557d9807a01b50c5be8b7f8340
Instruction Fuzzy Hash: 08114C71940208EFDB20EF1AD481A5CF3F6FB04B95F10899EEE4597290C770AA80CFA0

Function 02F8AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,02F8BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 02F8ABB9
InterlockedIncrement.KERNEL32(02F93640), ref: 02F8ABE1

Strings

%FROM_EMAIL, xrefs: 02F8AB8C

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: b4c3fbf62b5bd121b0f98228a2eaac25a099cca2e464a774afefc924029dc26d
Instruction ID: ca0e69103389a0d46cf53fa145192594b51208e3f8a4a57ed9f0743b1d3ecf18
Opcode Fuzzy Hash: b4c3fbf62b5bd121b0f98228a2eaac25a099cca2e464a774afefc924029dc26d
Instruction Fuzzy Hash: 070171319083C4AFEB11DF18D885F96BBA6EF55394F15488AF68047213C771E594CB91

Function 02F826B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 02F826C3
inet_ntoa.WS2_32(?), ref: 02F826E4

Strings

localcfg, xrefs: 02F826CD, 02F826D2, 02F826DE

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: c6f6c8a5a4fc28f574fab682de51f61ec6756a74e6a0bc7b088f41d992b836f1
Instruction ID: f50e416f16aadd1642de86e609b6624cd0365efae51d8279a8675ed98ddff131
Opcode Fuzzy Hash: c6f6c8a5a4fc28f574fab682de51f61ec6756a74e6a0bc7b088f41d992b836f1
Instruction Fuzzy Hash: 8CF037776482097FEF007FA4EC05AAA779DDF05690F144465FF08DA090DB71E950DB98

Function 02F8EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,02F8EB54,_alldiv,02F8F0B7,80000001,00000000,00989680,00000000,?,?,?,02F8E342,00000000,75A8EA50,80000001,00000000), ref: 02F8EAF2
GetProcAddress.KERNEL32(76E90000,00000000), ref: 02F8EB07

Strings

ntdll.dll, xrefs: 02F8EAED

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 9adae2df4db4727e1abb4f9119d58cbbd507e988321d2f321f1505afda45a670
Instruction ID: 33b6d558f3802fbcfc196de93e7438162016cf7b892aab9544218cab4eaed1d7
Opcode Fuzzy Hash: 9adae2df4db4727e1abb4f9119d58cbbd507e988321d2f321f1505afda45a670
Instruction Fuzzy Hash: 96D0C935E8030A9BEF125FA6AA0BE0AF6E8AB40BC1B404859B50AD1210EB30D464DF00

Function 02F82F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02F82D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,02F82F01,?,02F820FF,02F92000), ref: 02F82D3A
Part of subcall function 02F82D21: LoadLibraryA.KERNEL32(?), ref: 02F82D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02F82F73
HeapFree.KERNEL32(00000000), ref: 02F82F7A

Memory Dump Source

Source File: 00000011.00000002.2948445261.0000000002F80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02F80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: d57eca0904f596b0eccb3979c5be22b92a11136d6893fcaf5dd7348d470416ae
Instruction ID: 931d2c9f298a807be253e0169f6d5b23981390717bd899f0d5f1315d2d1fe590
Opcode Fuzzy Hash: d57eca0904f596b0eccb3979c5be22b92a11136d6893fcaf5dd7348d470416ae
Instruction Fuzzy Hash: 3A51917290024A9FDF01AF64DC88AF9F7B5FF05744F1045A9ED96D7220E7329A19CB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ewdWlNc8TL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ybuffopp.exe

C:\Windows\SysWOW64\rpfcsqnj\ybuffopp.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
ewdWlNc8TL.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre