Edit tour

Windows Analysis Report
ynhHNexysa.exe

Overview

General Information

Sample name:	ynhHNexysa.exe renamed because original name is a hash value
Original sample name:	3d33cbde84d0a1197ec0d459d634473e.exe
Analysis ID:	1482799
MD5:	3d33cbde84d0a1197ec0d459d634473e
SHA1:	abd0074c5b2eed8fbab4d30443ceac4b403ad09d
SHA256:	33647cf1d7ba05386d44a608a94979925883f8e8c0e5f63b3f2e7ffdc7380461
Tags:	32exetrojan
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

ynhHNexysa.exe (PID: 2412 cmdline: "C:\Users\user\Desktop\ynhHNexysa.exe" MD5: 3D33CBDE84D0A1197EC0D459D634473E)

ynhHNexysa.exe (PID: 2796 cmdline: "C:\Users\user\Desktop\ynhHNexysa.exe" MD5: 3D33CBDE84D0A1197EC0D459D634473E)

ynhHNexysa.exe (PID: 6104 cmdline: "C:\Users\user\Desktop\ynhHNexysa.exe" MD5: 3D33CBDE84D0A1197EC0D459D634473E)

ynhHNexysa.exe (PID: 2684 cmdline: "C:\Users\user\Desktop\ynhHNexysa.exe" MD5: 3D33CBDE84D0A1197EC0D459D634473E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "smtp.jlahuachem.com", "Username": "hunk.zhang@jlahuachem.com", "Password": "eGbB!FT9"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.4495357530.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.4495357530.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.4495357530.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: ynhHNexysa.exe PID: 2412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ynhHNexysa.exe PID: 2412	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ynhHNexysa.exe PID: 2412	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: ynhHNexysa.exe PID: 2684	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ynhHNexysa.exe PID: 2684	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.ynhHNexysa.exe.40240a8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ynhHNexysa.exe.40240a8.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ynhHNexysa.exe.40240a8.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33021:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33093:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3311d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331af:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33219:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3328b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33321:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333b1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ynhHNexysa.exe.3fa9990.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ynhHNexysa.exe.3fa9990.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ynhHNexysa.exe.3fa9990.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33021:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33093:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3311d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331af:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33219:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3328b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33321:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333b1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.ynhHNexysa.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.ynhHNexysa.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.ynhHNexysa.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34e21:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34e93:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34f1d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34faf:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35019:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3508b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35121:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x351b1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34e21:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34e93:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34f1d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34faf:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35019:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3508b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35121:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x351b1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ynhHNexysa.exe.40240a8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ynhHNexysa.exe.40240a8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ynhHNexysa.exe.40240a8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34e21:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x71241:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34e93:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x712b3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34f1d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x7133d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34faf:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x713cf:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35019:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71439:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3508b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x714ab:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35121:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71541:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x351b1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x715d1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.199.225, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\Desktop\ynhHNexysa.exe, Initiated: true, ProcessId: 2684, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49708

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T07:30:16.711253+0200
SID:	2022930
Source Port:	443
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T07:30:56.019190+0200
SID:	2022930
Source Port:	443
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ynhHNexysa.exe

Avira: detected

Found malware configuration

Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "smtp.jlahuachem.com", "Username": "hunk.zhang@jlahuachem.com", "Password": "eGbB!FT9"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ynhHNexysa.exe

Joe Sandbox ML: detected

Source: ynhHNexysa.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: ynhHNexysa.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 208.91.199.225 208.91.199.225
Source: Joe Sandbox View	IP Address: 208.91.199.223 208.91.199.223
Source: Joe Sandbox View	IP Address: 208.91.199.224 208.91.199.224

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 208.91.199.225:25
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 208.91.198.143:25
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 208.91.199.223:25
Source: global traffic	TCP traffic: 192.168.2.5:49708 -> 208.91.199.224:25

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.jlahuachem.com

Source: ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.jlahuachem.com
Source: ynhHNexysa.exe	String found in binary or memory: http://tempuri.org/dxsss.xsd
Source: ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: ynhHNexysa.exe, 00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: ynhHNexysa.exe, 00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, SKTzxzsJw.cs

.Net Code: agneM

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.ynhHNexysa.exe.40240a8.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ynhHNexysa.exe.3fa9990.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.ynhHNexysa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ynhHNexysa.exe.40240a8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_0162D304	0_2_0162D304
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_05637BD0	0_2_05637BD0
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_05630040	0_2_05630040
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_05630007	0_2_05630007
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_05637BC0	0_2_05637BC0
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_07604D30	0_2_07604D30
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_07604D11	0_2_07604D11
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_076055A0	0_2_076055A0
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_07606C78	0_2_07606C78
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_07605168	0_2_07605168
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_07606840	0_2_07606840
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_07606831	0_2_07606831
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 0_2_0760C800	0_2_0760C800
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00C2EEC0	5_2_00C2EEC0
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00C218A0	5_2_00C218A0
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00F641C8	5_2_00F641C8
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00F6E6B1	5_2_00F6E6B1
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00F6F7B0	5_2_00F6F7B0
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00F64A98	5_2_00F64A98
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00F63E80	5_2_00F63E80
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00F6A978	5_2_00F6A978
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_0670B638	5_2_0670B638
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_06707D78	5_2_06707D78
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_067065E8	5_2_067065E8
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_067055A0	5_2_067055A0
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_0670B217	5_2_0670B217
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_06703060	5_2_06703060
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_0670C180	5_2_0670C180
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_06707698	5_2_06707698
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_06705CCF	5_2_06705CCF
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_06702348	5_2_06702348
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_0670E3B0	5_2_0670E3B0
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_06700040	5_2_06700040
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_06700039	5_2_06700039

Source: ynhHNexysa.exe, 00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf29b00-c117-46a2-9260-1b0a359263de.exe4 vs ynhHNexysa.exe
Source: ynhHNexysa.exe, 00000000.00000002.2067938969.0000000007560000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs ynhHNexysa.exe
Source: ynhHNexysa.exe, 00000000.00000002.2065195598.000000000415E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs ynhHNexysa.exe
Source: ynhHNexysa.exe, 00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf29b00-c117-46a2-9260-1b0a359263de.exe4 vs ynhHNexysa.exe
Source: ynhHNexysa.exe, 00000000.00000002.2064767675.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf29b00-c117-46a2-9260-1b0a359263de.exe4 vs ynhHNexysa.exe
Source: ynhHNexysa.exe, 00000000.00000002.2064767675.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMML.dll2 vs ynhHNexysa.exe
Source: ynhHNexysa.exe, 00000000.00000002.2067506595.0000000005C10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMML.dll2 vs ynhHNexysa.exe
Source: ynhHNexysa.exe, 00000000.00000002.2063971815.00000000011FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ynhHNexysa.exe
Source: ynhHNexysa.exe, 00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf29b00-c117-46a2-9260-1b0a359263de.exe4 vs ynhHNexysa.exe
Source: ynhHNexysa.exe, 00000005.00000002.4492911660.0000000000AF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs ynhHNexysa.exe
Source: ynhHNexysa.exe	Binary or memory string: OriginalFilenameSxEh.exe< vs ynhHNexysa.exe

Source: ynhHNexysa.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.ynhHNexysa.exe.40240a8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ynhHNexysa.exe.3fa9990.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.ynhHNexysa.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ynhHNexysa.exe.40240a8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: ynhHNexysa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, wY0JxeJBuhumsKEEdp.cs	Security API names: _0020.SetAccessControl
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, wY0JxeJBuhumsKEEdp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, wY0JxeJBuhumsKEEdp.cs	Security API names: _0020.AddAccessRule
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, X1lGeNtrqa9RypnK1A.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, wY0JxeJBuhumsKEEdp.cs	Security API names: _0020.SetAccessControl
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, wY0JxeJBuhumsKEEdp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, wY0JxeJBuhumsKEEdp.cs	Security API names: _0020.AddAccessRule
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, X1lGeNtrqa9RypnK1A.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, X1lGeNtrqa9RypnK1A.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, wY0JxeJBuhumsKEEdp.cs	Security API names: _0020.SetAccessControl
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, wY0JxeJBuhumsKEEdp.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, wY0JxeJBuhumsKEEdp.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/1@2/5

Source: C:\Users\user\Desktop\ynhHNexysa.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ynhHNexysa.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Mutant created: \Sessions\1\BaseNamedObjects\nDULVUQYKBSQmTmUguHVQEG

Source: ynhHNexysa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ynhHNexysa.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\ynhHNexysa.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\ynhHNexysa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\ynhHNexysa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ynhHNexysa.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ynhHNexysa.exe "C:\Users\user\Desktop\ynhHNexysa.exe"
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process created: C:\Users\user\Desktop\ynhHNexysa.exe "C:\Users\user\Desktop\ynhHNexysa.exe"
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process created: C:\Users\user\Desktop\ynhHNexysa.exe "C:\Users\user\Desktop\ynhHNexysa.exe"
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process created: C:\Users\user\Desktop\ynhHNexysa.exe "C:\Users\user\Desktop\ynhHNexysa.exe"
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process created: C:\Users\user\Desktop\ynhHNexysa.exe "C:\Users\user\Desktop\ynhHNexysa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process created: C:\Users\user\Desktop\ynhHNexysa.exe "C:\Users\user\Desktop\ynhHNexysa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process created: C:\Users\user\Desktop\ynhHNexysa.exe "C:\Users\user\Desktop\ynhHNexysa.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: ynhHNexysa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ynhHNexysa.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, wY0JxeJBuhumsKEEdp.cs	.Net Code: oQDraBlY6e System.Reflection.Assembly.Load(byte[])
Source: 0.2.ynhHNexysa.exe.5c10000.5.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.ynhHNexysa.exe.5c10000.5.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, wY0JxeJBuhumsKEEdp.cs	.Net Code: oQDraBlY6e System.Reflection.Assembly.Load(byte[])
Source: 0.2.ynhHNexysa.exe.2fa6060.0.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.ynhHNexysa.exe.2fa6060.0.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, wY0JxeJBuhumsKEEdp.cs	.Net Code: oQDraBlY6e System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00C203D9 push es; ret	5_2_00C203DA
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00C29231 push cs; ret	5_2_00C2923E
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Code function: 5_2_00F60CCC push edi; retf	5_2_00F60C7A

Source: ynhHNexysa.exe

Static PE information: section name: .text entropy: 7.962364275489502

Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, VowUMM871Fp8bDemBP.cs	High entropy of concatenated method names: 'zg9NYQMDKL', 'gr9NyR2uIg', 'FjPNZeB3hh', 'COPZl1kGnD', 'ROJZzo0OQT', 'n03Ni2bJSi', 'fOPNcmWdZw', 'Ok1NxuDJSn', 'tNTN2HAADS', 'k31NrSbbHO'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, bLe1PVPXUhjRYjopUa.cs	High entropy of concatenated method names: 'SyeLk60tW4', 'hPNLEIREsG', 'DteLnPwbjp', 'VScLQyWdfy', 'M89LSDXina', 'yuJLfyVN5w', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, wY0JxeJBuhumsKEEdp.cs	High entropy of concatenated method names: 'XVh2Gyi6t8', 'hBk2YctEcf', 'U0F2j1g4Sv', 'Ijo2ytU9fJ', 'LMe2otdIYh', 'gbZ2ZQTjvv', 'rdF2Na0qE8', 'ePD2JuGhHT', 'DY62FcglJh', 'bHI2ABrSVB'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, X7eG0gqJtgFhfpo9cM.cs	High entropy of concatenated method names: 'bj1LYGylCf', 'DuILjg4Dy9', 'lWkLyDSM5Q', 'nwLLo67wt3', 'UYyLZuUlC1', 'jFSLN1EsAx', 'OdNLJxlV3l', 'qbVLF7g1mR', 'OjoLAHE5LB', 'xj0LKo2doe'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, bejyHZrHlbbQAjmPBF.cs	High entropy of concatenated method names: 'vnqcN1lGeN', 'dqacJ9Rypn', 'zYCcAyZPlc', 'rn4cKFjT12', 'LUGcObk3mR', 'PLOc3IxEnr', 'Vy8Ep7TJOShcrX5SCi', 'TNSZPuxa3W7DKHfEpy', 'Pm1cchrIdn', 'UULc2eXrSk'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, EHf4hJcibXDdIwrcxWa.cs	High entropy of concatenated method names: 'GPh5pEEQct', 'G8X5661gvI', 'CZy5a4U08p', 'nZq5DoGqW3', 'qtQ5vDuOw5', 'Dbd5gNEK89', 'gWY5Mrs8GO', 'WPk5tB5Bqy', 'quU5Vp7nWO', 'Vlm5COD7hk'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, yCyWgaVYCyZPlcLn4F.cs	High entropy of concatenated method names: 'HAkyDvYNmP', 'SZUygFHJ2Z', 'OB6ytO5xS2', 'FqoyVSWLUw', 'R2gyO81kuG', 'Byny3n9PuV', 'ldIyRO4C0b', 'b3AyLdkjvC', 'lVcy5bsjsd', 'iAyyBye0YT'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, VtoD4klVEdWHcS8xeB.cs	High entropy of concatenated method names: 'UKy5cLfb4A', 'pAC520I54m', 'kU65rwnIB8', 'Rn75Y4D6QV', 'V5o5jcNDob', 'kaI5o1TUkf', 'v5r5ZRd5oW', 'RmSL4qW8B5', 'j6vLqtV9OZ', 'OT5LP8RBa3'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, X1lGeNtrqa9RypnK1A.cs	High entropy of concatenated method names: 'YgDjSugHe4', 'DT5jH0yfm8', 'KRUjXQ6YTs', 'uAxjUmo3CE', 'P0njm9FbH3', 'WAAjuAM8tH', 'vsej4E0JEX', 'pXUjqZuKT1', 'faUjPRECx7', 'MJEjlVNm5U'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, xVUQskdyggVyKpAr72.cs	High entropy of concatenated method names: 'f7vwtj0SC7', 'VPSwVAQLac', 'KCxwkD0K3U', 'q4kwEhbKvQ', 'HqmwQXNXqe', 'Vvkwf2A3la', 'BjBw8A9SUF', 'jA7wek2HYU', 'pQkwbBk9qP', 'Q2kw9F4BSc'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, iRONNpzmxgNG0DqyUV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T1m5wH5Yn9', 'c4f5OG4nxb', 'l8l53mMuSI', 'oYl5RVOprX', 'MBE5LPrRa5', 'HqA55jdoXd', 'JZt5BrVR7F'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, pmR0LOkIxEnrctQD2X.cs	High entropy of concatenated method names: 'qABZGbaA0y', 'aYfZjSI0TR', 'ElfZoYxmKo', 'BBoZNK6vIh', 'C9IZJ9JLvg', 'lFUomIWgoi', 'APoou49NSs', 'CCNo4uAXLe', 'UbooqD3BQ1', 'hXIoP1GXO3'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, HJtwWsj8mZcgkhR8CY.cs	High entropy of concatenated method names: 'Dispose', 'NsocPAKa0p', 'KCHxEd7Emf', 'R2O11l3QCo', 'kP7cleG0gJ', 'DgFczhfpo9', 'ProcessDialogKey', 'aMcxiLe1PV', 'SUhxcjRYjo', 'xUaxxutoD4'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, B5YNRDX6ACF01eAiIM.cs	High entropy of concatenated method names: 'ToString', 'Nsu390Z1BA', 'SaK3ENTDJv', 'hYv3nYwqOF', 'l5p3QpgJcf', 'nxv3fUV4C0', 'Emm3IFGDOo', 'Gci38T8Vuf', 'lfZ3elmMS4', 'SmP3hsFWrT'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, VFbsN9QyklDZced5yE.cs	High entropy of concatenated method names: 'XI9ZWFwfw3', 'MB4Zpjy1Dv', 'JydZabIBKP', 'LlDZDr8k0K', 'NVnZg9hrSP', 'psfZMdItIL', 'SuGZVx1T8N', 'vVgZCUskbI', 'hk6skP40O4dnFp3QKhA', 'Ku7SwC4EoRAAoQHc0w5'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, U53X4duKhnr0sejxel.cs	High entropy of concatenated method names: 'q9dRqDGSLG', 'XXCRltWufr', 'f9hLiNpZdr', 'mXYLci3loj', 'qU7R9xDhQu', 'NXwR00hpPM', 'YNVRdI8EpX', 'pvERS8IniO', 'oOdRHqhjL0', 'hPORXC46NU'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, gBacBfc2y4FvbqjllAT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qNcBSa7Y5T', 'KHgBHecyXO', 'lRLBXZcd9H', 'LarBUEe9K9', 'pRWBm6E5qj', 'G32BunBv4O', 'b0vB4PbFXQ'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, l6A1ftxPNHNC6cEnNj.cs	High entropy of concatenated method names: 'MVqa9qiYD', 'Sv6DW5jXs', 'ccBgf7sAh', 'osjMMM8ul', 'Ra9VrVpAf', 'CSLCwFUEI', 'TY9Mjc82YuAdgD8rdA', 'yu16YS1rXxrEQugYJi', 'p80LVcEuh', 'DBYBgpLq1'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, gT12ZpCTTqeGReUGbk.cs	High entropy of concatenated method names: 'dLLovp63h9', 'W2loMMWpMV', 'R7PynHqqJc', 'Vq8yQJykct', 'ej6yf5RgtJ', 'fudyI4EVAe', 'cH7y8Ru1c8', 'Uc4yeTWctG', 'jusyhnZrry', 'hM3ybR2iyc'
Source: 0.2.ynhHNexysa.exe.7560000.7.raw.unpack, OLaIZShKLuCmYa6fj7.cs	High entropy of concatenated method names: 'u1WNpQWdGg', 'YJ5N6gw1sU', 'gJZNaklB4w', 'xkNNDuXVAC', 'KOkNv2uvko', 't2aNgvY8cw', 'y3UNMD6XNP', 'SgANtVvx2q', 'Pk4NVwtCu7', 'J9mNCWetml'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, VowUMM871Fp8bDemBP.cs	High entropy of concatenated method names: 'zg9NYQMDKL', 'gr9NyR2uIg', 'FjPNZeB3hh', 'COPZl1kGnD', 'ROJZzo0OQT', 'n03Ni2bJSi', 'fOPNcmWdZw', 'Ok1NxuDJSn', 'tNTN2HAADS', 'k31NrSbbHO'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, bLe1PVPXUhjRYjopUa.cs	High entropy of concatenated method names: 'SyeLk60tW4', 'hPNLEIREsG', 'DteLnPwbjp', 'VScLQyWdfy', 'M89LSDXina', 'yuJLfyVN5w', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, wY0JxeJBuhumsKEEdp.cs	High entropy of concatenated method names: 'XVh2Gyi6t8', 'hBk2YctEcf', 'U0F2j1g4Sv', 'Ijo2ytU9fJ', 'LMe2otdIYh', 'gbZ2ZQTjvv', 'rdF2Na0qE8', 'ePD2JuGhHT', 'DY62FcglJh', 'bHI2ABrSVB'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, X7eG0gqJtgFhfpo9cM.cs	High entropy of concatenated method names: 'bj1LYGylCf', 'DuILjg4Dy9', 'lWkLyDSM5Q', 'nwLLo67wt3', 'UYyLZuUlC1', 'jFSLN1EsAx', 'OdNLJxlV3l', 'qbVLF7g1mR', 'OjoLAHE5LB', 'xj0LKo2doe'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, bejyHZrHlbbQAjmPBF.cs	High entropy of concatenated method names: 'vnqcN1lGeN', 'dqacJ9Rypn', 'zYCcAyZPlc', 'rn4cKFjT12', 'LUGcObk3mR', 'PLOc3IxEnr', 'Vy8Ep7TJOShcrX5SCi', 'TNSZPuxa3W7DKHfEpy', 'Pm1cchrIdn', 'UULc2eXrSk'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, EHf4hJcibXDdIwrcxWa.cs	High entropy of concatenated method names: 'GPh5pEEQct', 'G8X5661gvI', 'CZy5a4U08p', 'nZq5DoGqW3', 'qtQ5vDuOw5', 'Dbd5gNEK89', 'gWY5Mrs8GO', 'WPk5tB5Bqy', 'quU5Vp7nWO', 'Vlm5COD7hk'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, yCyWgaVYCyZPlcLn4F.cs	High entropy of concatenated method names: 'HAkyDvYNmP', 'SZUygFHJ2Z', 'OB6ytO5xS2', 'FqoyVSWLUw', 'R2gyO81kuG', 'Byny3n9PuV', 'ldIyRO4C0b', 'b3AyLdkjvC', 'lVcy5bsjsd', 'iAyyBye0YT'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, VtoD4klVEdWHcS8xeB.cs	High entropy of concatenated method names: 'UKy5cLfb4A', 'pAC520I54m', 'kU65rwnIB8', 'Rn75Y4D6QV', 'V5o5jcNDob', 'kaI5o1TUkf', 'v5r5ZRd5oW', 'RmSL4qW8B5', 'j6vLqtV9OZ', 'OT5LP8RBa3'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, X1lGeNtrqa9RypnK1A.cs	High entropy of concatenated method names: 'YgDjSugHe4', 'DT5jH0yfm8', 'KRUjXQ6YTs', 'uAxjUmo3CE', 'P0njm9FbH3', 'WAAjuAM8tH', 'vsej4E0JEX', 'pXUjqZuKT1', 'faUjPRECx7', 'MJEjlVNm5U'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, xVUQskdyggVyKpAr72.cs	High entropy of concatenated method names: 'f7vwtj0SC7', 'VPSwVAQLac', 'KCxwkD0K3U', 'q4kwEhbKvQ', 'HqmwQXNXqe', 'Vvkwf2A3la', 'BjBw8A9SUF', 'jA7wek2HYU', 'pQkwbBk9qP', 'Q2kw9F4BSc'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, iRONNpzmxgNG0DqyUV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T1m5wH5Yn9', 'c4f5OG4nxb', 'l8l53mMuSI', 'oYl5RVOprX', 'MBE5LPrRa5', 'HqA55jdoXd', 'JZt5BrVR7F'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, pmR0LOkIxEnrctQD2X.cs	High entropy of concatenated method names: 'qABZGbaA0y', 'aYfZjSI0TR', 'ElfZoYxmKo', 'BBoZNK6vIh', 'C9IZJ9JLvg', 'lFUomIWgoi', 'APoou49NSs', 'CCNo4uAXLe', 'UbooqD3BQ1', 'hXIoP1GXO3'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, HJtwWsj8mZcgkhR8CY.cs	High entropy of concatenated method names: 'Dispose', 'NsocPAKa0p', 'KCHxEd7Emf', 'R2O11l3QCo', 'kP7cleG0gJ', 'DgFczhfpo9', 'ProcessDialogKey', 'aMcxiLe1PV', 'SUhxcjRYjo', 'xUaxxutoD4'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, B5YNRDX6ACF01eAiIM.cs	High entropy of concatenated method names: 'ToString', 'Nsu390Z1BA', 'SaK3ENTDJv', 'hYv3nYwqOF', 'l5p3QpgJcf', 'nxv3fUV4C0', 'Emm3IFGDOo', 'Gci38T8Vuf', 'lfZ3elmMS4', 'SmP3hsFWrT'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, VFbsN9QyklDZced5yE.cs	High entropy of concatenated method names: 'XI9ZWFwfw3', 'MB4Zpjy1Dv', 'JydZabIBKP', 'LlDZDr8k0K', 'NVnZg9hrSP', 'psfZMdItIL', 'SuGZVx1T8N', 'vVgZCUskbI', 'hk6skP40O4dnFp3QKhA', 'Ku7SwC4EoRAAoQHc0w5'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, U53X4duKhnr0sejxel.cs	High entropy of concatenated method names: 'q9dRqDGSLG', 'XXCRltWufr', 'f9hLiNpZdr', 'mXYLci3loj', 'qU7R9xDhQu', 'NXwR00hpPM', 'YNVRdI8EpX', 'pvERS8IniO', 'oOdRHqhjL0', 'hPORXC46NU'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, gBacBfc2y4FvbqjllAT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qNcBSa7Y5T', 'KHgBHecyXO', 'lRLBXZcd9H', 'LarBUEe9K9', 'pRWBm6E5qj', 'G32BunBv4O', 'b0vB4PbFXQ'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, l6A1ftxPNHNC6cEnNj.cs	High entropy of concatenated method names: 'MVqa9qiYD', 'Sv6DW5jXs', 'ccBgf7sAh', 'osjMMM8ul', 'Ra9VrVpAf', 'CSLCwFUEI', 'TY9Mjc82YuAdgD8rdA', 'yu16YS1rXxrEQugYJi', 'p80LVcEuh', 'DBYBgpLq1'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, gT12ZpCTTqeGReUGbk.cs	High entropy of concatenated method names: 'dLLovp63h9', 'W2loMMWpMV', 'R7PynHqqJc', 'Vq8yQJykct', 'ej6yf5RgtJ', 'fudyI4EVAe', 'cH7y8Ru1c8', 'Uc4yeTWctG', 'jusyhnZrry', 'hM3ybR2iyc'
Source: 0.2.ynhHNexysa.exe.42ecc90.3.raw.unpack, OLaIZShKLuCmYa6fj7.cs	High entropy of concatenated method names: 'u1WNpQWdGg', 'YJ5N6gw1sU', 'gJZNaklB4w', 'xkNNDuXVAC', 'KOkNv2uvko', 't2aNgvY8cw', 'y3UNMD6XNP', 'SgANtVvx2q', 'Pk4NVwtCu7', 'J9mNCWetml'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, VowUMM871Fp8bDemBP.cs	High entropy of concatenated method names: 'zg9NYQMDKL', 'gr9NyR2uIg', 'FjPNZeB3hh', 'COPZl1kGnD', 'ROJZzo0OQT', 'n03Ni2bJSi', 'fOPNcmWdZw', 'Ok1NxuDJSn', 'tNTN2HAADS', 'k31NrSbbHO'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, bLe1PVPXUhjRYjopUa.cs	High entropy of concatenated method names: 'SyeLk60tW4', 'hPNLEIREsG', 'DteLnPwbjp', 'VScLQyWdfy', 'M89LSDXina', 'yuJLfyVN5w', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, wY0JxeJBuhumsKEEdp.cs	High entropy of concatenated method names: 'XVh2Gyi6t8', 'hBk2YctEcf', 'U0F2j1g4Sv', 'Ijo2ytU9fJ', 'LMe2otdIYh', 'gbZ2ZQTjvv', 'rdF2Na0qE8', 'ePD2JuGhHT', 'DY62FcglJh', 'bHI2ABrSVB'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, X7eG0gqJtgFhfpo9cM.cs	High entropy of concatenated method names: 'bj1LYGylCf', 'DuILjg4Dy9', 'lWkLyDSM5Q', 'nwLLo67wt3', 'UYyLZuUlC1', 'jFSLN1EsAx', 'OdNLJxlV3l', 'qbVLF7g1mR', 'OjoLAHE5LB', 'xj0LKo2doe'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, bejyHZrHlbbQAjmPBF.cs	High entropy of concatenated method names: 'vnqcN1lGeN', 'dqacJ9Rypn', 'zYCcAyZPlc', 'rn4cKFjT12', 'LUGcObk3mR', 'PLOc3IxEnr', 'Vy8Ep7TJOShcrX5SCi', 'TNSZPuxa3W7DKHfEpy', 'Pm1cchrIdn', 'UULc2eXrSk'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, EHf4hJcibXDdIwrcxWa.cs	High entropy of concatenated method names: 'GPh5pEEQct', 'G8X5661gvI', 'CZy5a4U08p', 'nZq5DoGqW3', 'qtQ5vDuOw5', 'Dbd5gNEK89', 'gWY5Mrs8GO', 'WPk5tB5Bqy', 'quU5Vp7nWO', 'Vlm5COD7hk'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, yCyWgaVYCyZPlcLn4F.cs	High entropy of concatenated method names: 'HAkyDvYNmP', 'SZUygFHJ2Z', 'OB6ytO5xS2', 'FqoyVSWLUw', 'R2gyO81kuG', 'Byny3n9PuV', 'ldIyRO4C0b', 'b3AyLdkjvC', 'lVcy5bsjsd', 'iAyyBye0YT'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, VtoD4klVEdWHcS8xeB.cs	High entropy of concatenated method names: 'UKy5cLfb4A', 'pAC520I54m', 'kU65rwnIB8', 'Rn75Y4D6QV', 'V5o5jcNDob', 'kaI5o1TUkf', 'v5r5ZRd5oW', 'RmSL4qW8B5', 'j6vLqtV9OZ', 'OT5LP8RBa3'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, X1lGeNtrqa9RypnK1A.cs	High entropy of concatenated method names: 'YgDjSugHe4', 'DT5jH0yfm8', 'KRUjXQ6YTs', 'uAxjUmo3CE', 'P0njm9FbH3', 'WAAjuAM8tH', 'vsej4E0JEX', 'pXUjqZuKT1', 'faUjPRECx7', 'MJEjlVNm5U'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, xVUQskdyggVyKpAr72.cs	High entropy of concatenated method names: 'f7vwtj0SC7', 'VPSwVAQLac', 'KCxwkD0K3U', 'q4kwEhbKvQ', 'HqmwQXNXqe', 'Vvkwf2A3la', 'BjBw8A9SUF', 'jA7wek2HYU', 'pQkwbBk9qP', 'Q2kw9F4BSc'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, iRONNpzmxgNG0DqyUV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T1m5wH5Yn9', 'c4f5OG4nxb', 'l8l53mMuSI', 'oYl5RVOprX', 'MBE5LPrRa5', 'HqA55jdoXd', 'JZt5BrVR7F'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, pmR0LOkIxEnrctQD2X.cs	High entropy of concatenated method names: 'qABZGbaA0y', 'aYfZjSI0TR', 'ElfZoYxmKo', 'BBoZNK6vIh', 'C9IZJ9JLvg', 'lFUomIWgoi', 'APoou49NSs', 'CCNo4uAXLe', 'UbooqD3BQ1', 'hXIoP1GXO3'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, HJtwWsj8mZcgkhR8CY.cs	High entropy of concatenated method names: 'Dispose', 'NsocPAKa0p', 'KCHxEd7Emf', 'R2O11l3QCo', 'kP7cleG0gJ', 'DgFczhfpo9', 'ProcessDialogKey', 'aMcxiLe1PV', 'SUhxcjRYjo', 'xUaxxutoD4'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, B5YNRDX6ACF01eAiIM.cs	High entropy of concatenated method names: 'ToString', 'Nsu390Z1BA', 'SaK3ENTDJv', 'hYv3nYwqOF', 'l5p3QpgJcf', 'nxv3fUV4C0', 'Emm3IFGDOo', 'Gci38T8Vuf', 'lfZ3elmMS4', 'SmP3hsFWrT'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, VFbsN9QyklDZced5yE.cs	High entropy of concatenated method names: 'XI9ZWFwfw3', 'MB4Zpjy1Dv', 'JydZabIBKP', 'LlDZDr8k0K', 'NVnZg9hrSP', 'psfZMdItIL', 'SuGZVx1T8N', 'vVgZCUskbI', 'hk6skP40O4dnFp3QKhA', 'Ku7SwC4EoRAAoQHc0w5'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, U53X4duKhnr0sejxel.cs	High entropy of concatenated method names: 'q9dRqDGSLG', 'XXCRltWufr', 'f9hLiNpZdr', 'mXYLci3loj', 'qU7R9xDhQu', 'NXwR00hpPM', 'YNVRdI8EpX', 'pvERS8IniO', 'oOdRHqhjL0', 'hPORXC46NU'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, gBacBfc2y4FvbqjllAT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qNcBSa7Y5T', 'KHgBHecyXO', 'lRLBXZcd9H', 'LarBUEe9K9', 'pRWBm6E5qj', 'G32BunBv4O', 'b0vB4PbFXQ'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, l6A1ftxPNHNC6cEnNj.cs	High entropy of concatenated method names: 'MVqa9qiYD', 'Sv6DW5jXs', 'ccBgf7sAh', 'osjMMM8ul', 'Ra9VrVpAf', 'CSLCwFUEI', 'TY9Mjc82YuAdgD8rdA', 'yu16YS1rXxrEQugYJi', 'p80LVcEuh', 'DBYBgpLq1'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, gT12ZpCTTqeGReUGbk.cs	High entropy of concatenated method names: 'dLLovp63h9', 'W2loMMWpMV', 'R7PynHqqJc', 'Vq8yQJykct', 'ej6yf5RgtJ', 'fudyI4EVAe', 'cH7y8Ru1c8', 'Uc4yeTWctG', 'jusyhnZrry', 'hM3ybR2iyc'
Source: 0.2.ynhHNexysa.exe.436aab0.1.raw.unpack, OLaIZShKLuCmYa6fj7.cs	High entropy of concatenated method names: 'u1WNpQWdGg', 'YJ5N6gw1sU', 'gJZNaklB4w', 'xkNNDuXVAC', 'KOkNv2uvko', 't2aNgvY8cw', 'y3UNMD6XNP', 'SgANtVvx2q', 'Pk4NVwtCu7', 'J9mNCWetml'

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: ynhHNexysa.exe PID: 2412, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ynhHNexysa.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Memory allocated: 1620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Memory allocated: 2F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Memory allocated: 4F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Memory allocated: 7CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Memory allocated: 7610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Memory allocated: 8DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Memory allocated: 9DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Memory allocated: F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Memory allocated: 2A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Memory allocated: 4A40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Window / User API: threadDelayed 1776			Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Window / User API: threadDelayed 8079			Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 2556	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5344	Thread sleep count: 1776 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5344	Thread sleep count: 8079 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -99338s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -98574s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -98468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -98025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -97918s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -97797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -97641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -97527s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -97422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -97312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -97203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -97093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -96984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -96875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -96765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -96656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -96522s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -96406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -96297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -96187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -96078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -95969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -95859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -95750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -95640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -95531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -95422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -95312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -95203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -95094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -94984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -94874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -94766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -94656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -94547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe TID: 5304	Thread sleep time: -94437s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\ynhHNexysa.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\ynhHNexysa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\ynhHNexysa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 99338	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 98574	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 98025	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 97918	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 97641	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 97527	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 97422	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 97312	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 97203	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 97093	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 96984	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 96875	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 96765	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 96656	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 96522	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 96406	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 96297	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 96187	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 96078	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 95969	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 95859	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 95750	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 95640	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 95531	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 95422	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 95312	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 95203	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 95094	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 94984	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 94874	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 94766	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 94656	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 94547	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Thread delayed: delay time: 94437	Jump to behavior

Source: ynhHNexysa.exe, 00000005.00000002.4493699468.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\ynhHNexysa.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ynhHNexysa.exe

Memory written: C:\Users\user\Desktop\ynhHNexysa.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process created: C:\Users\user\Desktop\ynhHNexysa.exe "C:\Users\user\Desktop\ynhHNexysa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process created: C:\Users\user\Desktop\ynhHNexysa.exe "C:\Users\user\Desktop\ynhHNexysa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Process created: C:\Users\user\Desktop\ynhHNexysa.exe "C:\Users\user\Desktop\ynhHNexysa.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Users\user\Desktop\ynhHNexysa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Users\user\Desktop\ynhHNexysa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ynhHNexysa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.ynhHNexysa.exe.40240a8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ynhHNexysa.exe.3fa9990.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.ynhHNexysa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ynhHNexysa.exe.40240a8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4495357530.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4495357530.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ynhHNexysa.exe PID: 2412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ynhHNexysa.exe PID: 2684, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\ynhHNexysa.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ynhHNexysa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\ynhHNexysa.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ynhHNexysa.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\ynhHNexysa.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.ynhHNexysa.exe.40240a8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ynhHNexysa.exe.3fa9990.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.ynhHNexysa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ynhHNexysa.exe.40240a8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4495357530.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ynhHNexysa.exe PID: 2412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ynhHNexysa.exe PID: 2684, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.ynhHNexysa.exe.40240a8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ynhHNexysa.exe.3fa9990.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.ynhHNexysa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ynhHNexysa.exe.3fa9990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ynhHNexysa.exe.40240a8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4495357530.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4495357530.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ynhHNexysa.exe PID: 2412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ynhHNexysa.exe PID: 2684, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ynhHNexysa.exe	100%	Avira	HEUR/AGEN.1308749
ynhHNexysa.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://smtp.jlahuachem.com	0%	Avira URL Cloud	safe
http://us2.smtp.mailhostbox.com	0%	Avira URL Cloud	safe
http://tempuri.org/dxsss.xsd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
us2.smtp.mailhostbox.com	208.91.199.225	true	false	unknown
api.ipify.org	172.67.74.152	true	false	unknown
smtp.jlahuachem.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://smtp.jlahuachem.com	ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	ynhHNexysa.exe, 00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/dxsss.xsd	ynhHNexysa.exe	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	ynhHNexysa.exe, 00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://us2.smtp.mailhostbox.com	ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp, ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ynhHNexysa.exe, 00000005.00000002.4495357530.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.91.198.143	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.225	us2.smtp.mailhostbox.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.223	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.224	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482799
Start date and time:	2024-07-26 07:29:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ynhHNexysa.exe renamed because original name is a hash value
Original Sample Name:	3d33cbde84d0a1197ec0d459d634473e.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/1@2/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 92 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ynhHNexysa.exe

Simulations

Behavior and APIs

Time	Type	Description
01:29:55	API Interceptor	6526326x Sleep call for process: ynhHNexysa.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
208.91.198.143	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse
	file.exe	Get hash	malicious	SystemBC	Browse
	file.exe	Get hash	malicious	SystemBC	Browse
	LisectAVT_2403002A_52.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.14778.18726.exe	Get hash	malicious	AgentTesla	Browse
	8hOkq9mMQu.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Order List Pdf.exe	Get hash	malicious	AgentTesla	Browse
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Mt103.exe	Get hash	malicious	AgentTesla	Browse
	PO-070724-WA00002.exe	Get hash	malicious	AgentTesla	Browse
208.91.199.225	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse
	LisectAVT_2403002A_124.exe	Get hash	malicious	AgentTesla	Browse
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse
	IEnetcache.hta	Get hash	malicious	Cobalt Strike, AgentTesla, PureLog Stealer	Browse
	winiti.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	0RA0ngi2c2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	z1X3Z1ohoefF078ij.exe	Get hash	malicious	AgentTesla	Browse
	Products and Quote.exe	Get hash	malicious	AgentTesla	Browse
	Purchase Order.exe	Get hash	malicious	AgentTesla	Browse
	ATTACHMENT OF PAYMENT.exe	Get hash	malicious	AgentTesla	Browse
208.91.199.223	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse
	LCWGT83qLa.exe	Get hash	malicious	AgentTesla	Browse
	Solicitud urgente de presupuestoNueva colaboraci#U00f3n pdf.exe	Get hash	malicious	AgentTesla	Browse
	z2PKRSEkM9edbE7Om.exe	Get hash	malicious	AgentTesla	Browse
	SOA-Al Daleel.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.12946.7200.exe	Get hash	malicious	AgentTesla	Browse
	QUOTATION.exe	Get hash	malicious	AgentTesla	Browse
	Attached Quotation.exe	Get hash	malicious	AgentTesla	Browse
	Swift Copy_98754.bat.exe	Get hash	malicious	AgentTesla	Browse
208.91.199.224	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse
	PO-020716-WA0002.pdf..exe	Get hash	malicious	AgentTesla	Browse
	SOA-Al Daleel.exe	Get hash	malicious	AgentTesla	Browse
	SOA-Al Daleel.exe	Get hash	malicious	AgentTesla	Browse
	001 Tech. Spec pdf.exe	Get hash	malicious	AgentTesla	Browse
	Quotation No.06262024.exe	Get hash	malicious	AgentTesla	Browse
	Urgent PO.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	z1PURCHASEORDER736353.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	PO#0094321.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	file.exe	Get hash	malicious	SystemBC	Browse	208.91.199.224
	file.exe	Get hash	malicious	SystemBC	Browse	208.91.199.223
	LisectAVT_2403002A_124.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	LisectAVT_2403002A_52.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.14778.18726.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	LCWGT83qLa.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
api.ipify.org	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://pub-bc1e99c17d21413c8c62ead228907d1f.r2.dev/auth_gen.html?folder=inf0gudkij&module&user-agent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36	Get hash	malicious	Greatness Phishing Kit, HTMLPhisher	Browse	104.26.13.205
	https://b14d.lnsd.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	LisectAVT_2403002A_124.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	LisectAVT_2403002A_127.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_133.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_2.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_460.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_481.exe	Get hash	malicious	Luna Grabber, Luna Logger	Browse	104.26.12.205
	LisectAVT_2403002A_63.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	file.exe	Get hash	malicious	SystemBC	Browse	103.50.162.156
	file.exe	Get hash	malicious	SystemBC	Browse	103.50.162.156
	LisectAVT_2403002A_124.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	LisectAVT_2403002A_16.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	LisectAVT_2403002A_52.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	74.119.239.234
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
PUBLIC-DOMAIN-REGISTRYUS	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	file.exe	Get hash	malicious	SystemBC	Browse	103.50.162.156
	file.exe	Get hash	malicious	SystemBC	Browse	103.50.162.156
	LisectAVT_2403002A_124.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	LisectAVT_2403002A_16.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	LisectAVT_2403002A_52.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	74.119.239.234
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
PUBLIC-DOMAIN-REGISTRYUS	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	file.exe	Get hash	malicious	SystemBC	Browse	103.50.162.156
	file.exe	Get hash	malicious	SystemBC	Browse	103.50.162.156
	LisectAVT_2403002A_124.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	LisectAVT_2403002A_16.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	LisectAVT_2403002A_52.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	74.119.239.234
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
PUBLIC-DOMAIN-REGISTRYUS	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	file.exe	Get hash	malicious	SystemBC	Browse	103.50.162.156
	file.exe	Get hash	malicious	SystemBC	Browse	103.50.162.156
	LisectAVT_2403002A_124.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	LisectAVT_2403002A_16.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	LisectAVT_2403002A_52.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	74.119.239.234
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
CLOUDFLARENETUS	http://lotsa.pplanr.com	Get hash	malicious	Unknown	Browse	104.21.44.162
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	http://leostop.com	Get hash	malicious	Unknown	Browse	104.16.141.114
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	https://odc.officeapps.live.com.mcas.ms/odc/v2.1/hrd?rs=en-US&Ver=16&app=111&p=6&hm=0&fpEnabled=1&McasTsid=REDACTED	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	7Y18r(191).exe	Get hash	malicious	Unknown	Browse	104.16.149.130

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	7Y18r(191).exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	172.67.74.152
	7Y18r(191).exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	fps-booster.exe	Get hash	malicious	StormKitty	Browse	172.67.74.152
	https://metamaskwalletexetention.webflow.io/	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://56edthdxfhbx.pages.dev/	Get hash	malicious	TechSupportScam	Browse	172.67.74.152
	https://banco.estado-app.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://contact-office-kawai9lpoe9srsi9lpoe9srsi.narymar.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://gentle-union.wordsowd.workers.dev/	Get hash	malicious	Unknown	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\ynhHNexysa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.848719392804634
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	ynhHNexysa.exe
File size:	671'744 bytes
MD5:	3d33cbde84d0a1197ec0d459d634473e
SHA1:	abd0074c5b2eed8fbab4d30443ceac4b403ad09d
SHA256:	33647cf1d7ba05386d44a608a94979925883f8e8c0e5f63b3f2e7ffdc7380461
SHA512:	36f31309dddf020fd9fee7c44d8847924c4f8a9306a7f04dfa15fd2b73645c982f98d4b7a616b2b31d4b3c14510f2858608beda519eb8475780b544a4eedcea1
SSDEEP:	12288:6ChcU7r3FL0YtcCCvLLgov4CnDUOt7TDM2DG0oSb3fqEVzXfmhujHeis3c:Jco3FYYtajLX4stTA2DGbSeEUh+ei8c
TLSH:	71E412057B81A777D22FABB15111C2960BF2721B20B0D3FC1CDA3AB899E27D046A3747
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0......@......B.... ........@.. ... ...................@... ........@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x49fd42
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A1D211 [Thu Jul 25 04:18:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9fcf0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa0000	0x5e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9dd48	0x9e000	6ca31c7a27c5f4f31d963044cdf48407	False	0.960245253164557	data	7.962364275489502	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa0000	0x5e0	0x2000	e4c45285e393fe40e2c72b4476017462	False	0.0855712890625	data	1.0966777007684447	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa2000	0xc	0x2000	25ea05bb96e8c918e99eb4d6126291b2	False	0.005126953125	data	0.008814852707337104	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0090	0x350	data			0.4339622641509434
RT_MANIFEST	0xa03f0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T07:30:16.711253+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49711	40.68.123.157	192.168.2.5
2024-07-26T07:30:56.019190+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49717	40.68.123.157	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 07:29:57.732228994 CEST	49706	443	192.168.2.5	172.67.74.152
Jul 26, 2024 07:29:57.732323885 CEST	443	49706	172.67.74.152	192.168.2.5
Jul 26, 2024 07:29:57.732503891 CEST	49706	443	192.168.2.5	172.67.74.152
Jul 26, 2024 07:29:57.743882895 CEST	49706	443	192.168.2.5	172.67.74.152
Jul 26, 2024 07:29:57.743923903 CEST	443	49706	172.67.74.152	192.168.2.5
Jul 26, 2024 07:29:58.346380949 CEST	443	49706	172.67.74.152	192.168.2.5
Jul 26, 2024 07:29:58.346482992 CEST	49706	443	192.168.2.5	172.67.74.152
Jul 26, 2024 07:29:58.349952936 CEST	49706	443	192.168.2.5	172.67.74.152
Jul 26, 2024 07:29:58.349977970 CEST	443	49706	172.67.74.152	192.168.2.5
Jul 26, 2024 07:29:58.350405931 CEST	443	49706	172.67.74.152	192.168.2.5
Jul 26, 2024 07:29:58.404711008 CEST	49706	443	192.168.2.5	172.67.74.152
Jul 26, 2024 07:29:58.416848898 CEST	49706	443	192.168.2.5	172.67.74.152
Jul 26, 2024 07:29:58.464540958 CEST	443	49706	172.67.74.152	192.168.2.5
Jul 26, 2024 07:29:58.525414944 CEST	443	49706	172.67.74.152	192.168.2.5
Jul 26, 2024 07:29:58.525563002 CEST	443	49706	172.67.74.152	192.168.2.5
Jul 26, 2024 07:29:58.525825977 CEST	49706	443	192.168.2.5	172.67.74.152
Jul 26, 2024 07:29:58.555790901 CEST	49706	443	192.168.2.5	172.67.74.152
Jul 26, 2024 07:29:59.670833111 CEST	49708	25	192.168.2.5	208.91.199.225
Jul 26, 2024 07:30:00.670382023 CEST	49708	25	192.168.2.5	208.91.199.225
Jul 26, 2024 07:30:02.685961962 CEST	49708	25	192.168.2.5	208.91.199.225
Jul 26, 2024 07:30:06.701596022 CEST	49708	25	192.168.2.5	208.91.199.225
Jul 26, 2024 07:30:14.701581001 CEST	49708	25	192.168.2.5	208.91.199.225
Jul 26, 2024 07:30:20.704653978 CEST	49708	25	192.168.2.5	208.91.198.143
Jul 26, 2024 07:30:21.717278004 CEST	49708	25	192.168.2.5	208.91.198.143
Jul 26, 2024 07:30:23.733042002 CEST	49708	25	192.168.2.5	208.91.198.143
Jul 26, 2024 07:30:27.748655081 CEST	49708	25	192.168.2.5	208.91.198.143
Jul 26, 2024 07:30:35.764183998 CEST	49708	25	192.168.2.5	208.91.198.143
Jul 26, 2024 07:30:41.780111074 CEST	49708	25	192.168.2.5	208.91.199.223
Jul 26, 2024 07:30:42.779783010 CEST	49708	25	192.168.2.5	208.91.199.223
Jul 26, 2024 07:30:44.779861927 CEST	49708	25	192.168.2.5	208.91.199.223
Jul 26, 2024 07:30:48.779777050 CEST	49708	25	192.168.2.5	208.91.199.223
Jul 26, 2024 07:30:56.779781103 CEST	49708	25	192.168.2.5	208.91.199.223
Jul 26, 2024 07:31:02.780028105 CEST	49708	25	192.168.2.5	208.91.199.224
Jul 26, 2024 07:31:03.779814959 CEST	49708	25	192.168.2.5	208.91.199.224
Jul 26, 2024 07:31:05.779905081 CEST	49708	25	192.168.2.5	208.91.199.224
Jul 26, 2024 07:31:09.795511007 CEST	49708	25	192.168.2.5	208.91.199.224
Jul 26, 2024 07:31:17.811055899 CEST	49708	25	192.168.2.5	208.91.199.224
Jul 26, 2024 07:31:24.079329967 CEST	49718	25	192.168.2.5	208.91.199.225
Jul 26, 2024 07:31:25.093646049 CEST	49718	25	192.168.2.5	208.91.199.225
Jul 26, 2024 07:31:27.092525005 CEST	49718	25	192.168.2.5	208.91.199.225
Jul 26, 2024 07:31:31.108915091 CEST	49718	25	192.168.2.5	208.91.199.225
Jul 26, 2024 07:31:39.125735998 CEST	49718	25	192.168.2.5	208.91.199.225
Jul 26, 2024 07:31:45.123810053 CEST	49718	25	192.168.2.5	208.91.198.143
Jul 26, 2024 07:31:46.123491049 CEST	49718	25	192.168.2.5	208.91.198.143
Jul 26, 2024 07:31:48.123512983 CEST	49718	25	192.168.2.5	208.91.198.143
Jul 26, 2024 07:31:52.123553991 CEST	49718	25	192.168.2.5	208.91.198.143
Jul 26, 2024 07:32:00.279761076 CEST	49718	25	192.168.2.5	208.91.198.143
Jul 26, 2024 07:32:06.280030966 CEST	49718	25	192.168.2.5	208.91.199.223
Jul 26, 2024 07:32:07.281800985 CEST	49718	25	192.168.2.5	208.91.199.223
Jul 26, 2024 07:32:09.297744036 CEST	49718	25	192.168.2.5	208.91.199.223
Jul 26, 2024 07:32:13.295386076 CEST	49718	25	192.168.2.5	208.91.199.223
Jul 26, 2024 07:32:21.311064005 CEST	49718	25	192.168.2.5	208.91.199.223
Jul 26, 2024 07:32:27.327055931 CEST	49718	25	192.168.2.5	208.91.199.224
Jul 26, 2024 07:32:28.326634884 CEST	49718	25	192.168.2.5	208.91.199.224
Jul 26, 2024 07:32:30.326931953 CEST	49718	25	192.168.2.5	208.91.199.224
Jul 26, 2024 07:32:34.326647997 CEST	49718	25	192.168.2.5	208.91.199.224
Jul 26, 2024 07:32:42.326667070 CEST	49718	25	192.168.2.5	208.91.199.224

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 07:29:57.482494116 CEST	60835	53	192.168.2.5	1.1.1.1
Jul 26, 2024 07:29:57.721447945 CEST	53	60835	1.1.1.1	192.168.2.5
Jul 26, 2024 07:29:59.350464106 CEST	56231	53	192.168.2.5	1.1.1.1
Jul 26, 2024 07:29:59.669230938 CEST	53	56231	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 07:29:57.482494116 CEST	192.168.2.5	1.1.1.1	0x669c	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 07:29:59.350464106 CEST	192.168.2.5	1.1.1.1	0x7f81	Standard query (0)	smtp.jlahuachem.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 07:29:57.721447945 CEST	1.1.1.1	192.168.2.5	0x669c	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 26, 2024 07:29:57.721447945 CEST	1.1.1.1	192.168.2.5	0x669c	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 26, 2024 07:29:57.721447945 CEST	1.1.1.1	192.168.2.5	0x669c	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 26, 2024 07:29:59.669230938 CEST	1.1.1.1	192.168.2.5	0x7f81	No error (0)	smtp.jlahuachem.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 07:29:59.669230938 CEST	1.1.1.1	192.168.2.5	0x7f81	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Jul 26, 2024 07:29:59.669230938 CEST	1.1.1.1	192.168.2.5	0x7f81	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Jul 26, 2024 07:29:59.669230938 CEST	1.1.1.1	192.168.2.5	0x7f81	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Jul 26, 2024 07:29:59.669230938 CEST	1.1.1.1	192.168.2.5	0x7f81	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	172.67.74.152	443	2684	C:\Users\user\Desktop\ynhHNexysa.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 05:29:58 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-26 05:29:58 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 05:29:58 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8a91febc6e4172b6-EWR
2024-07-26 05:29:58 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	01:29:54
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\ynhHNexysa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ynhHNexysa.exe"
Imagebase:	0xc50000
File size:	671'744 bytes
MD5 hash:	3D33CBDE84D0A1197EC0D459D634473E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2065195598.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2065195598.0000000004024000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:29:56
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\ynhHNexysa.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ynhHNexysa.exe"
Imagebase:	0x410000
File size:	671'744 bytes
MD5 hash:	3D33CBDE84D0A1197EC0D459D634473E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:29:56
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\ynhHNexysa.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ynhHNexysa.exe"
Imagebase:	0x110000
File size:	671'744 bytes
MD5 hash:	3D33CBDE84D0A1197EC0D459D634473E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:29:56
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\ynhHNexysa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ynhHNexysa.exe"
Imagebase:	0x670000
File size:	671'744 bytes
MD5 hash:	3D33CBDE84D0A1197EC0D459D634473E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4495357530.0000000002AB5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4492696673.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.4495357530.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.4495357530.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.5%
Total number of Nodes:	326
Total number of Limit Nodes:	8

Executed Functions

Function 05637BD0 Relevance: 43.2, Strings: 33, Instructions: 1941
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&, xrefs: 0563803D
k, xrefs: 05639641
k, xrefs: 056392ED
_, xrefs: 0563964B
k, xrefs: 05638F1D
d, xrefs: 05638036
_, xrefs: 05639497
_, xrefs: 056392F7
(, xrefs: 05638089
_, xrefs: 05639125
k, xrefs: 05639813
_, xrefs: 05638F27
7, xrefs: 0563848D
i, xrefs: 0563884B
-, xrefs: 0563832F
Q, xrefs: 05638737
k, xrefs: 05638B8B
Pp]q, xrefs: 05638288
C, xrefs: 056383C6
(, xrefs: 05638082
k, xrefs: 0563911B
, xrefs: 05638AD6
k, xrefs: 0563948D
_, xrefs: 05638B95
k, xrefs: 05638D51
7, xrefs: 056381C2
, xrefs: 056388D7
7, xrefs: 0563861C
d, xrefs: 056387EB
_, xrefs: 0563981D
, xrefs: 05637F90
g, xrefs: 05637F97
_, xrefs: 05638D5B

Memory Dump Source

Source File: 00000000.00000002.2066890308.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $ $ $&$($($-$7$7$7$C$Pp]q$Q$_$_$_$_$_$_$_$_$d$d$g$i$k$k$k$k$k$k$k$k
API String ID: 0-3898640276
Opcode ID: 6f60ce4880862fec0dfa995f3b33b70cbd4a7249efa0c847edadc6e4bd8eb38e
Instruction ID: 8c5e970ce4a3af743bd5cf90024dc23585bffe99f321ac89c8c76bafefd9bc06
Opcode Fuzzy Hash: 6f60ce4880862fec0dfa995f3b33b70cbd4a7249efa0c847edadc6e4bd8eb38e
Instruction Fuzzy Hash: 3713F674A107198FC725EF38C895BAAB7B2FF89300F50869DD4496B360DB71AA85CF41

Function 05637BC0 Relevance: 43.2, Strings: 33, Instructions: 1931
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&, xrefs: 0563803D
k, xrefs: 05639641
k, xrefs: 056392ED
_, xrefs: 0563964B
k, xrefs: 05638F1D
d, xrefs: 05638036
_, xrefs: 05639497
_, xrefs: 056392F7
(, xrefs: 05638089
_, xrefs: 05639125
k, xrefs: 05639813
_, xrefs: 05638F27
7, xrefs: 0563848D
i, xrefs: 0563884B
-, xrefs: 0563832F
Q, xrefs: 05638737
k, xrefs: 05638B8B
Pp]q, xrefs: 05638288
C, xrefs: 056383C6
(, xrefs: 05638082
k, xrefs: 0563911B
, xrefs: 05638AD6
k, xrefs: 0563948D
_, xrefs: 05638B95
k, xrefs: 05638D51
7, xrefs: 056381C2
, xrefs: 056388D7
7, xrefs: 0563861C
d, xrefs: 056387EB
_, xrefs: 0563981D
, xrefs: 05637F90
g, xrefs: 05637F97
_, xrefs: 05638D5B

Memory Dump Source

Source File: 00000000.00000002.2066890308.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $ $ $&$($($-$7$7$7$C$Pp]q$Q$_$_$_$_$_$_$_$_$d$d$g$i$k$k$k$k$k$k$k$k
API String ID: 0-3898640276
Opcode ID: bba3248dfe0a8094008bf00e44821606dc9f5e9e0ad3a2160be819b8434b5c4a
Instruction ID: bf8c4daa1f9e261204af7a424e51586bc02a4f89e33be9795be436b5eb4e0f3d
Opcode Fuzzy Hash: bba3248dfe0a8094008bf00e44821606dc9f5e9e0ad3a2160be819b8434b5c4a
Instruction Fuzzy Hash: 6C13F674A107198FC725EF38C895BAAB7B2FF89300F50869DD4496B360DB71AA85CF41

Function 076079B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07607BF6

Strings

*, xrefs: 076079FB
*, xrefs: 07607A2A

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: CreateProcess
String ID: *$*
API String ID: 963392458-2806035931
Opcode ID: 86be8ec4f306423b6b9361f69d1eab665ee25201e2bd8565bddf02e179e382b6
Instruction ID: 73e388438845ac63c21818db5de41e90580caec9718ae98d7fe746f5158c3b9f
Opcode Fuzzy Hash: 86be8ec4f306423b6b9361f69d1eab665ee25201e2bd8565bddf02e179e382b6
Instruction Fuzzy Hash: 8FA14DB1D0025ADFDF28CF68C8417EEBBB2BF44314F1485A9D809A7280DB75A985CF91

Function 076079C0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07607BF6

Strings

*, xrefs: 076079FB
*, xrefs: 07607A2A

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: CreateProcess
String ID: *$*
API String ID: 963392458-2806035931
Opcode ID: 9aba83c3209910c41a6d61fd9890870ebf7a6254321d893e3b093941f58bcbd7
Instruction ID: 2d785a30cbef46de67718d9b3232490c3e08c359298901d2d86811cc811f7e43
Opcode Fuzzy Hash: 9aba83c3209910c41a6d61fd9890870ebf7a6254321d893e3b093941f58bcbd7
Instruction Fuzzy Hash: D3914CB1D0021ADFDF28CF68C8417EEBBB2BF44314F1485A9D809A7280DB75A985CF91

Function 056318E5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05631A02

Strings

*, xrefs: 0563193E
*, xrefs: 0563191E

Memory Dump Source

Source File: 00000000.00000002.2066890308.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_ynhHNexysa.jbxd

Similarity

API ID: CreateWindow
String ID: *$*
API String ID: 716092398-2806035931
Opcode ID: 4daa6f8e355b41c7990bc1448144d0f27280bd46b9e4fc064b6ea75942b084f9
Instruction ID: 8d8e6f2e48904a1d2956f62ba7e9770c1a506a8d273fcff92871512348c27b9d
Opcode Fuzzy Hash: 4daa6f8e355b41c7990bc1448144d0f27280bd46b9e4fc064b6ea75942b084f9
Instruction Fuzzy Hash: 4651D0B1C003499FDB14CF99C985ADEBBB5BF88310F24852AE419AB310DB74A985CF90

Function 056318F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05631A02

Strings

*, xrefs: 0563193E
*, xrefs: 0563191E

Memory Dump Source

Source File: 00000000.00000002.2066890308.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_ynhHNexysa.jbxd

Similarity

API ID: CreateWindow
String ID: *$*
API String ID: 716092398-2806035931
Opcode ID: b806c9ef45a6372d363eb37422ddcb7588440e70a942fa65d8a2d5b1eccc1989
Instruction ID: 5fd86f59bdcbc7ceb44c15bc6e7d8f0daed6cb4d4ddc3a9f5841323903320ed9
Opcode Fuzzy Hash: b806c9ef45a6372d363eb37422ddcb7588440e70a942fa65d8a2d5b1eccc1989
Instruction Fuzzy Hash: C141C1B1D003499FDB14CF99C885ADEBBB5FF89310F24812AE419AB350DB74A945CF90

Function 0162AD48 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0162AF9E

Strings

*, xrefs: 0162AF57

Memory Dump Source

Source File: 00000000.00000002.2064592244.0000000001620000.00000040.00000800.00020000.00000000.sdmp, Offset: 01620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1620000_ynhHNexysa.jbxd

Similarity

API ID: HandleModule
String ID: *
API String ID: 4139908857-4271904048
Opcode ID: 8cdfa345393cb8142e34cf2e74ae7cecb71b33240236a5b383f1a4fb81b258ac
Instruction ID: a529ab894aca0fa7b16b5c499a389bdf0f00e83fcddf8b6007c225d0d4be559f
Opcode Fuzzy Hash: 8cdfa345393cb8142e34cf2e74ae7cecb71b33240236a5b383f1a4fb81b258ac
Instruction Fuzzy Hash: B3711370A00B158FD724DF69D85475ABBF6FF88204F008929D48A97B50DBB5E846CF91

Function 016244D4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016259A9

Strings

*, xrefs: 0162592C

Memory Dump Source

Source File: 00000000.00000002.2064592244.0000000001620000.00000040.00000800.00020000.00000000.sdmp, Offset: 01620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1620000_ynhHNexysa.jbxd

Similarity

API ID: Create
String ID: *
API String ID: 2289755597-4271904048
Opcode ID: 2536030cb5cc01689a4f1c08c6a0862576683aac5aea9e3824ee0ed64f16c72c
Instruction ID: 6b6cc31c4f123f4c770c87abb3da4eef39584f557cbe1456475c70dc73ac321c
Opcode Fuzzy Hash: 2536030cb5cc01689a4f1c08c6a0862576683aac5aea9e3824ee0ed64f16c72c
Instruction Fuzzy Hash: C941B0B0C00729CBDB24DFA9C884BDEBBF5BF49304F20806AD419AB255DB756946CF91

Function 016258EC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016259A9

Strings

*, xrefs: 0162592C

Memory Dump Source

Source File: 00000000.00000002.2064592244.0000000001620000.00000040.00000800.00020000.00000000.sdmp, Offset: 01620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1620000_ynhHNexysa.jbxd

Similarity

API ID: Create
String ID: *
API String ID: 2289755597-4271904048
Opcode ID: 629a9316b4f995057d85b00f0e4eaf113fc7b2a23df0c194345c491d16c2a982
Instruction ID: e3929f89c443adb275ea7007e6caa2a1933173ca9bf89a00cc800831d13b7cd2
Opcode Fuzzy Hash: 629a9316b4f995057d85b00f0e4eaf113fc7b2a23df0c194345c491d16c2a982
Instruction Fuzzy Hash: 9C41EDB0C00719CADB24DFA9C984BDEBBB5BF48304F20806AD409AB255DB75694ACF91

Function 05634050 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05634111

Strings

*, xrefs: 05634067

Memory Dump Source

Source File: 00000000.00000002.2066890308.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_ynhHNexysa.jbxd

Similarity

API ID: CallProcWindow
String ID: *
API String ID: 2714655100-4271904048
Opcode ID: d4d737ef7915ad3e30530c0e5cbd3cc84494b0dc06e54e79e5499485a9c7c63b
Instruction ID: 2990593b1ca99c234beddde28ef7e416cfda69de77bc7e72f8c75ec3fd8c549c
Opcode Fuzzy Hash: d4d737ef7915ad3e30530c0e5cbd3cc84494b0dc06e54e79e5499485a9c7c63b
Instruction Fuzzy Hash: F1413AB4A007058FCB14CF89C449AAAFBF5FF89314F24C499D519A7321D774A845CFA0

Function 07607732 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 076077C8

Strings

*, xrefs: 07607757

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: *
API String ID: 3559483778-4271904048
Opcode ID: 7ffdcce46568aed5acd04c37aadd42c8336a4f0a9d93ccb18678ef7350054994
Instruction ID: 2b1cb91254d71fe361e96056dcc49bedaf6e54b3e140fc98ed191b75249b9958
Opcode Fuzzy Hash: 7ffdcce46568aed5acd04c37aadd42c8336a4f0a9d93ccb18678ef7350054994
Instruction Fuzzy Hash: FC2128B59002499FCB14DFA9C885BEEBBF1FF88310F10882AE519A7240D7789945CBA1

Function 07607738 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 076077C8

Strings

*, xrefs: 07607757

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: *
API String ID: 3559483778-4271904048
Opcode ID: 0db3bad3789272dcb4759bd043241f0e7fda32094c677075edd19be2449166ec
Instruction ID: 4894bc52f4ced4a24733fa5c7013d1e632dce9345a1d1b81ecb2a87ab160374b
Opcode Fuzzy Hash: 0db3bad3789272dcb4759bd043241f0e7fda32094c677075edd19be2449166ec
Instruction Fuzzy Hash: 482126B59003499FCB14DFA9C885BEEBBF5FF48310F108829E919A7240D778A944CBA0

Function 07607598 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0760761E

Strings

*, xrefs: 076075BC

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: ContextThreadWow64
String ID: *
API String ID: 983334009-4271904048
Opcode ID: cc00c62fdbdd348a3610709c2a7d7214fdb3e16bb73a0df18891285775c5b2b4
Instruction ID: 944a96c8dd7294a718cfaa2ac234fdb983904d4e44bad7eb50f731cf64bb51d6
Opcode Fuzzy Hash: cc00c62fdbdd348a3610709c2a7d7214fdb3e16bb73a0df18891285775c5b2b4
Instruction Fuzzy Hash: E62116B59003099FDB14DFAAC4857AEFBF4FF48314F10842AD55AA7240CB78A945CFA5

Function 07607820 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 076078A8

Strings

*, xrefs: 07607847

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: MemoryProcessRead
String ID: *
API String ID: 1726664587-4271904048
Opcode ID: 37bd4e89e8e769e18b3ea0fb71fa0613a480d0d1f51ae3c9e057231529b731ef
Instruction ID: 3d538423bb1f45398cd773f89f98958f92a713b766b05783e9fc16c75ca13788
Opcode Fuzzy Hash: 37bd4e89e8e769e18b3ea0fb71fa0613a480d0d1f51ae3c9e057231529b731ef
Instruction Fuzzy Hash: A2214AB1C002499FCB14DFAAD8416EEFBF5FF88310F10842AE919A7240D738A945CBA1

Function 0162B730 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0162D5E6,?,?,?,?,?), ref: 0162D6A7

Strings

*, xrefs: 0162D63F

Memory Dump Source

Source File: 00000000.00000002.2064592244.0000000001620000.00000040.00000800.00020000.00000000.sdmp, Offset: 01620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1620000_ynhHNexysa.jbxd

Similarity

API ID: DuplicateHandle
String ID: *
API String ID: 3793708945-4271904048
Opcode ID: c4bfc15a5842e3fdf9c7ca626ebfb699367c1cdbfb7be2cac624ee2be8c0cea9
Instruction ID: 34d26d69f7f30f0a01a3b60dc7ce5d482d49801a95e3258b20ae4b767736faf4
Opcode Fuzzy Hash: c4bfc15a5842e3fdf9c7ca626ebfb699367c1cdbfb7be2cac624ee2be8c0cea9
Instruction Fuzzy Hash: 4321E4B59002589FDB10DF9AD984AEEFFF8FB48310F14841AE918A7350D378A944CFA5

Function 076075A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0760761E

Strings

*, xrefs: 076075BC

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: ContextThreadWow64
String ID: *
API String ID: 983334009-4271904048
Opcode ID: 0241693366665cacbebcfa5466837fd755d75c450fb367ef61b4632a69c32d7e
Instruction ID: 7c995a54fdff092d14be3d99e886d48e0dd20878e46b46f2e86deaa9c1b495e0
Opcode Fuzzy Hash: 0241693366665cacbebcfa5466837fd755d75c450fb367ef61b4632a69c32d7e
Instruction Fuzzy Hash: 902134B5D002098FDB14DFAAC4857EEBBF4EF88314F10842AD45AA7240CB78A945CBA1

Function 07607828 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 076078A8

Strings

*, xrefs: 07607847

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: MemoryProcessRead
String ID: *
API String ID: 1726664587-4271904048
Opcode ID: d81ca0f62a0a7989f83a2b957830ace4bf5c28fb3afeef92f8a8b5ea0be342d4
Instruction ID: 2fa86c9dffa212db27f2e4d1e9ae39967bfa1c85091f42617154a0ff49824cbb
Opcode Fuzzy Hash: d81ca0f62a0a7989f83a2b957830ace4bf5c28fb3afeef92f8a8b5ea0be342d4
Instruction Fuzzy Hash: 242139B1C003499FDB14DFAAC845AEEFBF5FF48310F108429E519A7240D778A945CBA1

Function 0162D618 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0162D5E6,?,?,?,?,?), ref: 0162D6A7

Strings

*, xrefs: 0162D63F

Memory Dump Source

Source File: 00000000.00000002.2064592244.0000000001620000.00000040.00000800.00020000.00000000.sdmp, Offset: 01620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1620000_ynhHNexysa.jbxd

Similarity

API ID: DuplicateHandle
String ID: *
API String ID: 3793708945-4271904048
Opcode ID: 197c8c401552f8dda8a50009dc02c884ebc8ceb65923a75e586098f66c714447
Instruction ID: 77d0f91a4ecdda4840c8a84cf368d5346186950feee5151152319a60a9a3b8fc
Opcode Fuzzy Hash: 197c8c401552f8dda8a50009dc02c884ebc8ceb65923a75e586098f66c714447
Instruction Fuzzy Hash: 2821E3B5D002189FDB10CF9AD984AEEBBF5EB48310F14841AE918B3350D378A944CF61

Function 07607672 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 076076E6

Strings

*, xrefs: 0760768F

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: AllocVirtual
String ID: *
API String ID: 4275171209-4271904048
Opcode ID: 8135b85d32b306f0f9ab3b4e5699940dd8bb61a8c13afec7de69d13f78a5965b
Instruction ID: 92c40546cb4754eb924c053504e4370ee7e03d31982f753ccd0fbd6677948458
Opcode Fuzzy Hash: 8135b85d32b306f0f9ab3b4e5699940dd8bb61a8c13afec7de69d13f78a5965b
Instruction Fuzzy Hash: FE115CB59002499FCB10DFAAD8456DFFFF5EF88320F108819D519A7250C775A544CBA1

Function 0162A108 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0162B019,00000800,00000000,00000000), ref: 0162B22A

Strings

*, xrefs: 0162B1DF

Memory Dump Source

Source File: 00000000.00000002.2064592244.0000000001620000.00000040.00000800.00020000.00000000.sdmp, Offset: 01620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1620000_ynhHNexysa.jbxd

Similarity

API ID: LibraryLoad
String ID: *
API String ID: 1029625771-4271904048
Opcode ID: 75c1b7b3d4b8868eed09b06476ba0103dffe46f4b0ac96c4f8ed2566578ee631
Instruction ID: c8887182d41038f726ac77fb1b1b2cf6d80429dddbbf4e7b99df4e143eaa1156
Opcode Fuzzy Hash: 75c1b7b3d4b8868eed09b06476ba0103dffe46f4b0ac96c4f8ed2566578ee631
Instruction Fuzzy Hash: 7C1129B5C007088FDB10DF9AD844AEEFBF4EB49310F10842AD519A7300C379A545CFA5

Function 0162B1B9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0162B019,00000800,00000000,00000000), ref: 0162B22A

Strings

*, xrefs: 0162B1DF

Memory Dump Source

Source File: 00000000.00000002.2064592244.0000000001620000.00000040.00000800.00020000.00000000.sdmp, Offset: 01620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1620000_ynhHNexysa.jbxd

Similarity

API ID: LibraryLoad
String ID: *
API String ID: 1029625771-4271904048
Opcode ID: e484e7d05cbfb7664312e432c979c0c90a4211dd06ac662de5f319879e9a0457
Instruction ID: 9406c3d8b4a16534e37d56b8af45c10f5df11eb82bd28d896a3ddaa774dfbc30
Opcode Fuzzy Hash: e484e7d05cbfb7664312e432c979c0c90a4211dd06ac662de5f319879e9a0457
Instruction Fuzzy Hash: 0B1112B68007088FDB10CF9AD844BEEFBF4EB89310F10842AD519A7700C379A545CFA5

Function 07607678 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 076076E6

Strings

*, xrefs: 0760768F

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: AllocVirtual
String ID: *
API String ID: 4275171209-4271904048
Opcode ID: b004e5056a919fe9d3156f4ea2073eacd67b5fb794cd0f072d8820a4636a69d5
Instruction ID: 980b8001c98942e0c9941cad2add397499d58a5edbc3e04565b78dbb7d1e815a
Opcode Fuzzy Hash: b004e5056a919fe9d3156f4ea2073eacd67b5fb794cd0f072d8820a4636a69d5
Instruction Fuzzy Hash: 85110AB59002499FCB14DFAAC845ADFFFF5EF88310F148819D519A7250C779A544CFA1

Function 0760C2D8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,0760C191,?,?), ref: 0760C338

Strings

*, xrefs: 0760C2FA

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: *
API String ID: 2591292051-4271904048
Opcode ID: d28b3f0057efd1c2bdf2e910250d4d734372411ddb95c7e32c2a83bbeff02dd0
Instruction ID: 04afbb60c0bcbcfe4cf53a2323b9f929b5904a252e0ab24b01f17645f795363d
Opcode Fuzzy Hash: d28b3f0057efd1c2bdf2e910250d4d734372411ddb95c7e32c2a83bbeff02dd0
Instruction Fuzzy Hash: 811155B58002498FCB24DF99D445BEEBBF4EB88320F10842AD559A3340C338A985CFA1

Function 076074E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07607552

Strings

*, xrefs: 07607507

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: ResumeThread
String ID: *
API String ID: 947044025-4271904048
Opcode ID: ce5fad777c6601a8de42a0dafabed37d1a72cd2512d2059393a1f411ac39096a
Instruction ID: 3b233eed724b41a17b80ffd9d3a10f1cd6e2de9da8b808b3b428c7072c4e53b5
Opcode Fuzzy Hash: ce5fad777c6601a8de42a0dafabed37d1a72cd2512d2059393a1f411ac39096a
Instruction Fuzzy Hash: 731149B1C003488FCB14DFAAC4456EEFBF4EF88314F108819D519A7240CB78A944CBA1

Function 0760BA80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,0760C191,?,?), ref: 0760C338

Strings

*, xrefs: 0760C2FA

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: *
API String ID: 2591292051-4271904048
Opcode ID: ed810cf365461f61ffd3f94805cc7bf3f199d584e86df4506d4b193892125c17
Instruction ID: 63aa6e9bcbcaee5c4af75f8dc1d141be002712f89c26b118e949566f2f9f8114
Opcode Fuzzy Hash: ed810cf365461f61ffd3f94805cc7bf3f199d584e86df4506d4b193892125c17
Instruction Fuzzy Hash: 4B1125B58002499FCB14DF9AC545BEEBBF4EB48320F10881AD559A7340D778A945CFA5

Function 076074F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07607552

Strings

*, xrefs: 07607507

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: ResumeThread
String ID: *
API String ID: 947044025-4271904048
Opcode ID: 267c9528a33a3040a2838eac81cfc7b05e6c8e6e16ca3e89496c0a786a9ab363
Instruction ID: b8253ed48af61609fe8a44d9ae386e3f77b87ded1edf4e03d3742c932d8d1d01
Opcode Fuzzy Hash: 267c9528a33a3040a2838eac81cfc7b05e6c8e6e16ca3e89496c0a786a9ab363
Instruction Fuzzy Hash: E31125B1D002498BCB24DFAAC4457EEFBF5EF88324F208819D519A7340CB79A944CBA1

Function 07609EF0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0760A5D5

Strings

*, xrefs: 0760A592

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: MessagePost
String ID: *
API String ID: 410705778-4271904048
Opcode ID: db1e7bfb3af3a91f2d39235405b16017904e1c72b937510cbfd9f5460e29de40
Instruction ID: b937c72563a41a6898c9d622a3f9c1ca0f50fa503cf21a954c335584903dd33c
Opcode Fuzzy Hash: db1e7bfb3af3a91f2d39235405b16017904e1c72b937510cbfd9f5460e29de40
Instruction Fuzzy Hash: CA11F2B58003499FCB10DF9AD489BEEBBF8FB49310F108819E519A7340D379A944CFA1

Function 0162AF38 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0162AF9E

Strings

*, xrefs: 0162AF57

Memory Dump Source

Source File: 00000000.00000002.2064592244.0000000001620000.00000040.00000800.00020000.00000000.sdmp, Offset: 01620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1620000_ynhHNexysa.jbxd

Similarity

API ID: HandleModule
String ID: *
API String ID: 4139908857-4271904048
Opcode ID: fb2891301762feaa4dbccb6b7c1d858a0eca16b025046d6de2837bfe91f91401
Instruction ID: 430adab136c242cacaaf24bd5bd5473f350c67ec682207f29a4174a6322dec35
Opcode Fuzzy Hash: fb2891301762feaa4dbccb6b7c1d858a0eca16b025046d6de2837bfe91f91401
Instruction Fuzzy Hash: C81110B5C006498FDB10DF9AD844ADEFBF4EF88314F10842AD918A7740C3B9A545CFA1

Function 0760A570 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0760A5D5

Strings

*, xrefs: 0760A592

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID: MessagePost
String ID: *
API String ID: 410705778-4271904048
Opcode ID: e45aa0f3f27bb84ba4c8387518926b4f2763b0f5b4820402d04c09d5eed68076
Instruction ID: 80d6614f2aaf0d8550db8c343e0897f469727f011af657946cc7789714d50d9d
Opcode Fuzzy Hash: e45aa0f3f27bb84ba4c8387518926b4f2763b0f5b4820402d04c09d5eed68076
Instruction Fuzzy Hash: EB1110B58003499FCB10DF99C488BDEFBF4FB48310F10885AE559A7650C378A944CFA1

Function 015CD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2064385417.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98a186d5d7b20b23ea32239b96d2c185bfa45eba1a8f578d7560c2dbdc99114
Instruction ID: 1ec41f37b77a1990d1e9a315d357a41671082697244ce130200f53d41e605dc9
Opcode Fuzzy Hash: d98a186d5d7b20b23ea32239b96d2c185bfa45eba1a8f578d7560c2dbdc99114
Instruction Fuzzy Hash: F921F171100204DFDB05DF98C9C0B6ABFB5FB88714F20857DDA098E256C37AE406C6E1

Function 015DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2064445620.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298985e4b69e0ef510d93368a8c3f43a288c707a2e447aa3d0fd0616e52e9817
Instruction ID: 241a84d5fb5eae767306f2fbbafe6543b8a04cc5b9ecc9e13141b7e49fb37162
Opcode Fuzzy Hash: 298985e4b69e0ef510d93368a8c3f43a288c707a2e447aa3d0fd0616e52e9817
Instruction Fuzzy Hash: B3210071604204DFCB25DF6CD980B26BFB5FB88314F20C969D90A4F296D33AD406CBA1

Function 015DD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2064445620.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13152f8ae3c7b48f38fe3a1ebbc4da3b129e80906f6be6e980c8cc40a59918c
Instruction ID: e91db0b64ef1ce4082aa7ed68d72213843cf67a1ff64e615e7926dd6ca6ae79d
Opcode Fuzzy Hash: d13152f8ae3c7b48f38fe3a1ebbc4da3b129e80906f6be6e980c8cc40a59918c
Instruction Fuzzy Hash: 2421D371544204AFDB25DFA8D980B26BBB5FB84324F20C96DD9494F296C33AD446CB61

Function 015DD005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2064445620.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbb4407db537e072a131b90d0a7993b75b40d5ecd2861b3cf176692e8073150
Instruction ID: 25cf9fa6699f64721e1dc6f9b20ff7014d3c4a0b2a1b9fb4fb2c4a8f468daa7b
Opcode Fuzzy Hash: fcbb4407db537e072a131b90d0a7993b75b40d5ecd2861b3cf176692e8073150
Instruction Fuzzy Hash: BB2183755083849FCB13CF68D994715BF71FB86214F28C5DAD8498F2A7D33A9806CB62

Function 015CD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2064385417.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 6ab952ccc636442c65e04d52a324e803330a1c82771b4ad062ea636bcb6326b4
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: E311CD72404240DFDB02CF84D9C4B5ABF71FB84224F24C6ADDA094A256C37AE45ACBA2

Function 015DD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2064445620.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 6934d2350de23a538f3517ec0df803ac430453170dc98ad12f2d2d5743d83a05
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: BA11BB75504280DFDB12CF58C5C4B19BFB1FB84224F24C6A9D8494F696C33AD40ACB62

Non-executed Functions

Function 0760C800 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721b8f7a8e6931a5ecf13bbd1a825f1ab3ab456e3f83493eff61a4c93fab3e35
Instruction ID: cc8b793a40a9eec5e7a3331dcf3867d00fe2f34edc3c500e9e3826f59cfa905a
Opcode Fuzzy Hash: 721b8f7a8e6931a5ecf13bbd1a825f1ab3ab456e3f83493eff61a4c93fab3e35
Instruction Fuzzy Hash: 33D1B8B0700A158BDB29DB75C850BAF77FAAF89600F14856DD14ACB7D0DB74E801CBA5

Function 05630040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066890308.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6939905a121692c3911ddcb740cd405047c8c41cfb073fc8f380f64fcb7cc6
Instruction ID: 04fe900f2700716ab396c8c6c7d93bb8f6e181c54d9e70497cb1392bf9eda0d4
Opcode Fuzzy Hash: fd6939905a121692c3911ddcb740cd405047c8c41cfb073fc8f380f64fcb7cc6
Instruction Fuzzy Hash: 491275F0C8974A8AD710CF65E94C189BAB1FB45398BD04B09D2B27F2E1DBB4156ACF44

Function 07604D30 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6a637dc61f830313c1036790e45ab876887df20c6d059fb0b1824e570b33e1
Instruction ID: c7afa90799e1e8d7f3a11d66e41a7ca44bbc39d564da5c0363b5fc545324b397
Opcode Fuzzy Hash: bb6a637dc61f830313c1036790e45ab876887df20c6d059fb0b1824e570b33e1
Instruction Fuzzy Hash: 95E11CB4E002598FCB18DFA9C5809AEFBF2FF89305F248169D515AB356D731A941CFA0

Function 076055A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c55e49f6539e922924dcea01a3e3bcd972440c05c27e221b8c4561297b36311
Instruction ID: cce7cdf7bdceb8c76652b43bc07f8da81310187614299605898483fa1201f9d2
Opcode Fuzzy Hash: 8c55e49f6539e922924dcea01a3e3bcd972440c05c27e221b8c4561297b36311
Instruction Fuzzy Hash: D3E1FAB4E001198FDB18DFA9C5849AEFBF2BF89305F248159E416AB356D730AD41CFA1

Function 07606C78 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0ee84dd42b1168cb93780059df8285c89e73eb07eed28ed719eae5a4f71344
Instruction ID: e465d154b052ba6ac0a5056f1d4937d60f0c5ed203e50a42a7b205e9d8e48c72
Opcode Fuzzy Hash: be0ee84dd42b1168cb93780059df8285c89e73eb07eed28ed719eae5a4f71344
Instruction Fuzzy Hash: 4DE1FCB4E002198FCB14DFA9C590AAEFBF2FF89305F248169D415AB356D731A941CFA1

Function 07605168 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0ae09dea47daaff424f28b4ecd099c60d1206b6523c91774169ff71276d701
Instruction ID: 52713484b7b548b0bf07a47db7af52af55806068fb67fa03ba404637f13c3dec
Opcode Fuzzy Hash: fe0ae09dea47daaff424f28b4ecd099c60d1206b6523c91774169ff71276d701
Instruction Fuzzy Hash: 26E10EB4E001198FCB18DFA9C5909AEFBF2FF89305F248159E416AB356D730A945CFA1

Function 07606840 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c276eeb08e34e5bfd6579befd9074d1e143eda2e0457627ea9ff89f155f82d6
Instruction ID: f03d835327beef80cca1fab9baec3f0e6416fe0e8fbd596c4d7cf0b376bbdc62
Opcode Fuzzy Hash: 5c276eeb08e34e5bfd6579befd9074d1e143eda2e0457627ea9ff89f155f82d6
Instruction Fuzzy Hash: 07E1E9B4E001198FCB18DFA9C5909AEBBF2FF89305F248169D415AB356D731AD41CFA1

Function 0162D304 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2064592244.0000000001620000.00000040.00000800.00020000.00000000.sdmp, Offset: 01620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1620000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1557a40a815f64876ddbae087c40579d3e4dedbe73f8e9721985ffa85cab166f
Instruction ID: 148c2f31525cd3ff6bb878398e2f0b003c93dd8dba460e98d96f9be68cc658b5
Opcode Fuzzy Hash: 1557a40a815f64876ddbae087c40579d3e4dedbe73f8e9721985ffa85cab166f
Instruction Fuzzy Hash: F7A18031E0062A8FCF05DFB4C85499EBBB2FF94300B1585AAE901BB261DB35E916CF40

Function 05630007 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066890308.0000000005630000.00000040.00000800.00020000.00000000.sdmp, Offset: 05630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5630000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f8f32b1f4a14e0acd423cbad35d093065af38c10d1ca14c68fcae61e2fa43b
Instruction ID: 88c91a227dca604c2f9fdd01390b2f6e9e3a684d1e88fa8af1c8beb91f7c3d73
Opcode Fuzzy Hash: 70f8f32b1f4a14e0acd423cbad35d093065af38c10d1ca14c68fcae61e2fa43b
Instruction Fuzzy Hash: 0DC107B0C8474A8AD711CF75E84C189BBB2FB85398F904B19D1B27B2E1DBB4146ACF44

Function 07604D11 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d0c0034b5b125fd24cc41fce2d65cf1610e58ec7d505783bd23ea7b0b66253
Instruction ID: 61a38e05805a152d75045fd9b01727c937dfd964f4000b3dbf8624e4fe4c4f33
Opcode Fuzzy Hash: d9d0c0034b5b125fd24cc41fce2d65cf1610e58ec7d505783bd23ea7b0b66253
Instruction Fuzzy Hash: B0514EB1E002598FCB18DF69C5405AEFBF2FF89315F24816AD419A7356D7309A42CFA1

Function 07606831 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2068370111.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7600000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3a35545d27b14d17535eb83da5b7944ce5643038ef68f314cf8246dab53918
Instruction ID: e10c3d1d4d46932b9d418f7e827bad0d86f1bbba6eadffc8d90698fd9fddefae
Opcode Fuzzy Hash: 9c3a35545d27b14d17535eb83da5b7944ce5643038ef68f314cf8246dab53918
Instruction Fuzzy Hash: 8551FCB4E002198FCB18DFA9C5805AEBBF2BF89305F24C5AAD419A7356D7309D45CFA1

Analysis Process: ynhHNexysa.exePID: 2684, Parent PID: 2412COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	117
Total number of Limit Nodes:	11

Executed Functions

Function 06703060 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06703736
$]q, xrefs: 0670375F
$]q, xrefs: 06703742
$]q, xrefs: 06703783
$]q, xrefs: 0670376B
$]q, xrefs: 0670378F

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: f9c73427452f07936db8b7c2bab085364f2fc06a33edcb621dd6cddb9268ed74
Instruction ID: 9df386bddb71bcfccb51f6f6c81bab6b79cc6d65911d75db2430196b522ef0bc
Opcode Fuzzy Hash: f9c73427452f07936db8b7c2bab085364f2fc06a33edcb621dd6cddb9268ed74
Instruction Fuzzy Hash: A6323E31E1061ACFDB15EF79D89459DB7F2FF89310F20C6AAD409A7254EB30A985CB90

Function 0670B638 Relevance: 8.0, Strings: 6, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0670BC01
$]q, xrefs: 0670BBA5
$]q, xrefs: 0670BC0D
$]q, xrefs: 0670BBCD
$]q, xrefs: 0670BBD9
$]q, xrefs: 0670BB99

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 821126ea79bf5c8161349c728c5d2d1518fcc5589298c2395de3ba9bb28237fc
Instruction ID: fe8213a1c75d55a4effda4a4afb7f06246c070c91c09d5eca6428838b72883f8
Opcode Fuzzy Hash: 821126ea79bf5c8161349c728c5d2d1518fcc5589298c2395de3ba9bb28237fc
Instruction Fuzzy Hash: B2026D30E1020ACFEBA4CBA8D580AADB7F5FB45714F108526D405DB395DB36DE46CBA1

Function 06707D78 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067080B5
$]q, xrefs: 067080C1

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 95fb8c6d290b1bd7e1dabffd061cc6c89580cbf9c6c9c8477e7a06cc5b01918b
Instruction ID: e57981930f822d9f645431e846dae42ded4c248847c1c61eabcd70a2c4885912
Opcode Fuzzy Hash: 95fb8c6d290b1bd7e1dabffd061cc6c89580cbf9c6c9c8477e7a06cc5b01918b
Instruction Fuzzy Hash: B9028C30B01206DFEB58DF68D890A6EB7E6FF84304F148529D4099B395DB35EC46CBA2

Function 067055A0 Relevance: 1.8, Strings: 1, Instructions: 588COMMON

Download Yara Rule

Strings

$, xrefs: 06705C71

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 4d122e74dda3ad2d757c4be1dff5c55526c24578f4f841eb29049d85bf28ab76
Instruction ID: afc555d1adedbd4b1ee475750f1cc1609ddfaaec68449b03185a7279427ce495
Opcode Fuzzy Hash: 4d122e74dda3ad2d757c4be1dff5c55526c24578f4f841eb29049d85bf28ab76
Instruction Fuzzy Hash: EC22A035E00205CFFB64DBA4CA806AEB7F2EB84314F208569D409AB385DB35DD42CFA1

Function 06702348 Relevance: 1.0, Instructions: 1004COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6324fe4bc4ea2f14ab36c891047a27304171709a1b2ec9b66fa70c7e5fa92b
Instruction ID: cc7d723a1debe1c6b8df638105dc690ed91d1fe4a2192bac806db6aca5585f1f
Opcode Fuzzy Hash: 0a6324fe4bc4ea2f14ab36c891047a27304171709a1b2ec9b66fa70c7e5fa92b
Instruction Fuzzy Hash: 57927735E00204CFEB64DB68C588A6DB7F2FB45314F54C4A9D419AB3A2DB35ED85CBA0

Function 067065E8 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7cfebe1c3e3a819310d28f1afd9c2b60d786ab84339c240cde4a3e706b15ef
Instruction ID: cc9579e08c7bbf5353921f41691c566dc239b13a11421f5a5623f545d8c9f344
Opcode Fuzzy Hash: 6e7cfebe1c3e3a819310d28f1afd9c2b60d786ab84339c240cde4a3e706b15ef
Instruction Fuzzy Hash: 1462AC34B10205CFEB54DB68D594AADB7F2EF88314F248469E40ADB394DB35ED46CBA0

Function 0670C180 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f72a6b8168b948981d830b5eeea9281d6c24505bc2ceda77b8d15e6457c434
Instruction ID: 02b03c6102f543d7bf47b2cef59ea90964295c37a873c19c3729846b94d374cc
Opcode Fuzzy Hash: 39f72a6b8168b948981d830b5eeea9281d6c24505bc2ceda77b8d15e6457c434
Instruction Fuzzy Hash: 8132AF34B00205CFEB55DFA8D990AAEB7F6EB89310F108525E406E7395DB35EC46CBA1

Function 0670B217 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a657285dd8793bd6561616b33a88955df7730a69c97c0992a073949919ada3
Instruction ID: a80a0914468611c3d987e2be8d17a2a356945ea353844f4ba6dbf311830e2b4c
Opcode Fuzzy Hash: 89a657285dd8793bd6561616b33a88955df7730a69c97c0992a073949919ada3
Instruction Fuzzy Hash: 8C224030E10109DFEB64DBA8D5807BEB7E6EB45710F208525E445DB3D1DA36DE81CBA1

Function 0670ACC0 Relevance: 10.4, Strings: 8, Instructions: 412
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0670AE40
$]q, xrefs: 0670AE63
$]q, xrefs: 0670AE6F
$]q, xrefs: 0670AE8C
$]q, xrefs: 0670ADED
$]q, xrefs: 0670AE34
$]q, xrefs: 0670ADE1
$]q, xrefs: 0670AE98

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: e274ef9dbed9dddc46bae4fc70ee5301982ef3568af732ec2bf8ea257affba55
Instruction ID: f7305531c317faa6dbd2447e409f62fca218504e4f0d0c2c175e4722639b7630
Opcode Fuzzy Hash: e274ef9dbed9dddc46bae4fc70ee5301982ef3568af732ec2bf8ea257affba55
Instruction Fuzzy Hash: 00E19030E1030ACFDB69DF68D8906AEB7F6EF85300F208529D4059B395DB75E946CBA1

Function 00C263C8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C26456
GetCurrentThread.KERNEL32 ref: 00C26493
GetCurrentProcess.KERNEL32 ref: 00C264D0
GetCurrentThreadId.KERNEL32 ref: 00C26529

Memory Dump Source

Source File: 00000005.00000002.4493088335.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_ynhHNexysa.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 99dc7a518eea57680b27d8cf1335d2bf2bd70f5534aee9b869869abcad06372a
Instruction ID: 2187559c81374f59580e8efaf95fd803eb2074703e25c03e58dc1f974bd25c34
Opcode Fuzzy Hash: 99dc7a518eea57680b27d8cf1335d2bf2bd70f5534aee9b869869abcad06372a
Instruction Fuzzy Hash: BA5167B09103498FDB14DFAAE548BAEBBF1FF48314F208459E059A73A0D774A944CB75

Function 00C263D8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C26456
GetCurrentThread.KERNEL32 ref: 00C26493
GetCurrentProcess.KERNEL32 ref: 00C264D0
GetCurrentThreadId.KERNEL32 ref: 00C26529

Memory Dump Source

Source File: 00000005.00000002.4493088335.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_ynhHNexysa.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4fa665d64c5496b8cd2746114d3a482a1b29c94a1243bead3480e68b99353ad7
Instruction ID: 3f4c5ee1f3de2e83eb8417f5da011c4c8f23fae67cfc0f6868bff28335f43fb5
Opcode Fuzzy Hash: 4fa665d64c5496b8cd2746114d3a482a1b29c94a1243bead3480e68b99353ad7
Instruction Fuzzy Hash: DC5147B09102498FDB14DFAAE548BAEBBF5FF48314F20C459E019A73A0D774A944CF65

Function 06709148 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067091CA
$]q, xrefs: 0670918F
$]q, xrefs: 067091D6
$]q, xrefs: 0670919B

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 6860005eb682cd9b8b4e235cff4ecfecf165a934427b219db060496abedc0631
Instruction ID: e645b11b2d0b04d23148f8c03edd4f58efaa7f923cceb33a654c875b1e5178ff
Opcode Fuzzy Hash: 6860005eb682cd9b8b4e235cff4ecfecf165a934427b219db060496abedc0631
Instruction Fuzzy Hash: 54915F31B0060A9FEB94DF65D8507AFB3F6FF84204F108465D909EB385EB319D468BA1

Function 0670CF50 Relevance: 4.5, Strings: 3, Instructions: 797
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0670D35B
$]q, xrefs: 0670D34F
$]q, xrefs: 0670D347

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: e1068400c1e2e3991ec5c1df2bde57bbe92d93eedad98edcccbf04a88bdff403
Instruction ID: af3e6841bb8793b138b0045664b1d5945b00da13cf642cba22fb6821de5328a1
Opcode Fuzzy Hash: e1068400c1e2e3991ec5c1df2bde57bbe92d93eedad98edcccbf04a88bdff403
Instruction Fuzzy Hash: 39622E34600206CFDB65EFA8D590A5EB7E6FF85304B20C928D0099F399DB75ED4ACB91

Function 06704B68 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Obq, xrefs: 06704D43
XPbq, xrefs: 06704CB9
fbq, xrefs: 06704B93

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 67cf12f37fe0ca51877b359d635079106c0be699e9713bfb92fbf7371d7efca9
Instruction ID: c47557dfdf4dca736bae7b8d222a20e16dd551a8e8f6e62cd3af5c46808e9fea
Opcode Fuzzy Hash: 67cf12f37fe0ca51877b359d635079106c0be699e9713bfb92fbf7371d7efca9
Instruction Fuzzy Hash: 24616231E00219DFEB549FA8C8547AEBBF6FF88700F208429D209AB3D5DB754D458BA5

Function 06709137 Relevance: 2.7, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

$]q, xrefs: 067091CA
$]q, xrefs: 0670918F

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 761ffbec7873264a4f30a797a2440fed5280029d0dd9f53c68e9250aa2797452
Instruction ID: 129a0ad95d06ee6d52aa1730194c534058fb1d21f2dbcf55b31ece0f77a8aeea
Opcode Fuzzy Hash: 761ffbec7873264a4f30a797a2440fed5280029d0dd9f53c68e9250aa2797452
Instruction Fuzzy Hash: 5E514231B005069FEB55DBB8D850B6FB3F6EB88604F108869D50AEB395DB319D43CBA1

Function 06704B59 Relevance: 2.6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

XPbq, xrefs: 06704CB9
fbq, xrefs: 06704B93

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: ea91e2703ccbc92b4d969f808bf6820aedc9dc03206e19f4d7e072b643214e0a
Instruction ID: a4dd6bf1c6be93f726f8420c5a79f03621bd190ff42d37520fbed057f70248e5
Opcode Fuzzy Hash: ea91e2703ccbc92b4d969f808bf6820aedc9dc03206e19f4d7e072b643214e0a
Instruction Fuzzy Hash: 1B518530F00209DFEB549FA5C854BAEBAF6FF88700F208529E105AB3D5DA758C458BA1

Function 00C2E7D8 Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C2EA3E

Memory Dump Source

Source File: 00000005.00000002.4493088335.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_ynhHNexysa.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 17d0b226fc56461f24ac04e646fda35e1526cca99816bd2449e5c18992e2a37e
Instruction ID: 98364cc28e5462e1cc30164b4b965ed333247e8b63eeec9434e5d73c237fda91
Opcode Fuzzy Hash: 17d0b226fc56461f24ac04e646fda35e1526cca99816bd2449e5c18992e2a37e
Instruction Fuzzy Hash: 07815670A00B558FD724DF2AE44179ABBF5FF88300F00892ED49AE7A91DB75E945CB90

Function 00F6EB48 Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4494599389.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f60000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c282b5f90efa3565d3167a31060540db1564a7af08c3243309d90c0cc2da5c
Instruction ID: 7839f573317a1af6fb00a6dde0fd085c319e5ef7f9844520ed4bcce4518adfcf
Opcode Fuzzy Hash: 67c282b5f90efa3565d3167a31060540db1564a7af08c3243309d90c0cc2da5c
Instruction Fuzzy Hash: EA513532D043598FCB14CF69D8446EABBF6AFCA310F14856BD805A7291DB34AC45CBE1

Function 00C2661F Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C266A7

Memory Dump Source

Source File: 00000005.00000002.4493088335.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_ynhHNexysa.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fff3b5ba14133a8b14a2f8fdeb52de5c0f1461693fed22a45b74e269af28b385
Instruction ID: 86586a964d1afb4257a515786647a9139ee0a799890e6825b808db28936fb221
Opcode Fuzzy Hash: fff3b5ba14133a8b14a2f8fdeb52de5c0f1461693fed22a45b74e269af28b385
Instruction Fuzzy Hash: 4321E2B59002489FDB10CFAAD984AEEBFF5FB48310F14801AE918A7350C378A944CFA0

Function 00C26620 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C266A7

Memory Dump Source

Source File: 00000005.00000002.4493088335.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_ynhHNexysa.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: afff796471d5b7731e69f4e44194cf58d8e9873b862271574c60f0563d575b50
Instruction ID: db7fb7e8a8061de433939e5e1c5e677efc42626d4887a2c0102fb2a57b390cfe
Opcode Fuzzy Hash: afff796471d5b7731e69f4e44194cf58d8e9873b862271574c60f0563d575b50
Instruction Fuzzy Hash: C421C2B59002589FDB10CFAAD984ADEBBF9FB48310F14841AE918A7350D379A944CFA5

Function 00C2EC38 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C2EAB9,00000800,00000000,00000000), ref: 00C2ECAA

Memory Dump Source

Source File: 00000005.00000002.4493088335.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_ynhHNexysa.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b6156daae0fe2104ce838c78e64fd3f3df622522a96e2686394a31162624aeca
Instruction ID: 31f1d2ade51a6c84c23436d5b33ca447442beaf9f49a3ce6c752726fded4f18b
Opcode Fuzzy Hash: b6156daae0fe2104ce838c78e64fd3f3df622522a96e2686394a31162624aeca
Instruction Fuzzy Hash: A81112B68003089FDB10CF9AD544ADEFBF4EB88320F10842AE429B7700C379A945CFA4

Function 00C2D780 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C2EAB9,00000800,00000000,00000000), ref: 00C2ECAA

Memory Dump Source

Source File: 00000005.00000002.4493088335.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_ynhHNexysa.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b5741f3bf80c2f88b466870a41941702456a546fc9d9e04bab4964ca9be7b071
Instruction ID: aa297f573af42824f6ec2f16a3a39ceddfce1fd7d3afbfff7b09dd9cbc65275b
Opcode Fuzzy Hash: b5741f3bf80c2f88b466870a41941702456a546fc9d9e04bab4964ca9be7b071
Instruction Fuzzy Hash: E01114B68003589FDB10CF9AD544ADEFBF4EB88320F10842AE919B7700C379A945CFA5

Function 00F6EC30 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00F6EC97

Memory Dump Source

Source File: 00000005.00000002.4494599389.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f60000_ynhHNexysa.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c31bba261fab92b8359af105032d57d0c4122d9395104661a94bdd48cdf3860b
Instruction ID: 58c53ca5b4bbda7199b9907b47d13b9f4ce9b9cedc755591a71012989aa76cc8
Opcode Fuzzy Hash: c31bba261fab92b8359af105032d57d0c4122d9395104661a94bdd48cdf3860b
Instruction Fuzzy Hash: 00111FB2C006599FCB10DF9AC544A9EFBF4AF48320F10812AD818A7241D378A940CFA1

Function 00C2E9D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C2EA3E

Memory Dump Source

Source File: 00000005.00000002.4493088335.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c20000_ynhHNexysa.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 102d3a1bc9082d6bb823f5ac0fd4654e6a2df637e505e4a2bfa80c320b866b50
Instruction ID: 939a4e6c1b37c659d205f266e024a11a5534f853fb77a8ac43800df162643310
Opcode Fuzzy Hash: 102d3a1bc9082d6bb823f5ac0fd4654e6a2df637e505e4a2bfa80c320b866b50
Instruction Fuzzy Hash: F3110FB6C002498FCB10CF9AD444A9EFBF4AB88310F10841AD829B7600C379A545CFA1

Function 0670DAC5 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0670DC21

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: b52961e01f76268796229921ad66d4b74ea87b4746f724e80db5042169c36465
Instruction ID: 067d14693dbf7969c9f1fe3fcad47f42b29caaa199114f3a355d41cdc007e898
Opcode Fuzzy Hash: b52961e01f76268796229921ad66d4b74ea87b4746f724e80db5042169c36465
Instruction Fuzzy Hash: D441B030E0034ADFEB64DFA5D5506AEBBF2EF85300F20852AD405D7281EB759946CBA1

Function 067021BD Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0670230B

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 32f5d129dfd9bdc377198e8a301b5fd567636d0a56a9af3254a2c03491eec320
Instruction ID: 2241760e77acb27ebd5df1fa78061707d4404693bb3981da0746cd50004e606d
Opcode Fuzzy Hash: 32f5d129dfd9bdc377198e8a301b5fd567636d0a56a9af3254a2c03491eec320
Instruction Fuzzy Hash: 3E31CE31B102418FEB99ABB4C96466E7BE2EF89200B148468D406DB396DB35CE46C7B1

Function 067021D0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0670230B

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 528ab3e9f38601d641157293b1e2f4b2cbff71e78cb334799c6f4f01d3048c64
Instruction ID: 63ad033be79ee495fbca3a9d69c83fdd6ab96a931ada31de1cbb83c16a29f56c
Opcode Fuzzy Hash: 528ab3e9f38601d641157293b1e2f4b2cbff71e78cb334799c6f4f01d3048c64
Instruction Fuzzy Hash: 8631E131B10201CFEB99ABB4D95866E7AE6EF89200F108438D406DB396DF35DE46C7B5

Function 067061E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e1a845ea054fdb4e7f541271d5cbc93d85c11f9fd1fd03056b9ae6266cd965
Instruction ID: fe833c206da01c32fa3ae713d5de7427504d32a770a337c4be97fe180ad75126
Opcode Fuzzy Hash: e9e1a845ea054fdb4e7f541271d5cbc93d85c11f9fd1fd03056b9ae6266cd965
Instruction Fuzzy Hash: 3C61A171F000118FDB54AB6EC890A6FBADBAFD4224F154479E80EDB3A4DE65DD0287E1

Function 06704298 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9256e72476242cfc2428e222e5390a61b235d2b24b9bd07c4879558363d8b302
Instruction ID: e9c295bb10237e129963e5947c9f4a6e1c11b23acc7e4b52bc899165268411c4
Opcode Fuzzy Hash: 9256e72476242cfc2428e222e5390a61b235d2b24b9bd07c4879558363d8b302
Instruction Fuzzy Hash: 56815E34B002069FEB54DFA8C45476EB7F2EF89304F118528D50AEB398DB35DC468BA1

Function 067045B8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b164510a4a2fe418563b8247b07c9a391648c0db1487364dc31f9e7ebf7a13d
Instruction ID: 54696f12c20455586264e16de1013fbc719e3f95d47e7c55883fdd3fd7ce0e95
Opcode Fuzzy Hash: 9b164510a4a2fe418563b8247b07c9a391648c0db1487364dc31f9e7ebf7a13d
Instruction Fuzzy Hash: 9C913E30E10619CFEF60DF64C890B9DB7B1FF85304F208595D549AB295EB70AE85CB91

Function 067045D0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324d63d7341d763d8fe8fd4231e0747ca493ad36d1201cb079b04ae3938fe5e6
Instruction ID: 676d7d1eb76295d5ad3fdd5997471e61277e8775edff770bc0746f9038e3a5bb
Opcode Fuzzy Hash: 324d63d7341d763d8fe8fd4231e0747ca493ad36d1201cb079b04ae3938fe5e6
Instruction Fuzzy Hash: 4C911D30E10619CBEF60DF68C890B9DB7B1FF85304F208595D54DAB295EB70AA85CF51

Function 0670EF28 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927aea847bd859b76f45d2f4da08093f194fcd2dd4b688e3a480add202add1f9
Instruction ID: 72ba16c9979022504f6559d1d93f6af1a7d523847237cc6dfaf2e199177ee663
Opcode Fuzzy Hash: 927aea847bd859b76f45d2f4da08093f194fcd2dd4b688e3a480add202add1f9
Instruction Fuzzy Hash: 8D711F70A00209DFDB54DFA9D990A9EBBF6FF84304F248429E409DB395DB35E946CB60

Function 0670EF38 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccca91fdc38952c49e2793cc79d049c8d45b948dd111f88519321859f8778947
Instruction ID: 311e6845e0cbf240f47403388d33a327947345006804a40bf5137f92092964e1
Opcode Fuzzy Hash: ccca91fdc38952c49e2793cc79d049c8d45b948dd111f88519321859f8778947
Instruction Fuzzy Hash: 00711C70A00209DFDB54DFA9D990AAEBBF6FF84304F148429E409DB395DB35E946CB60

Function 0670FC90 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ae1f0cd26f95fb7a245857ce5db63d4ae2c4b1855e6f98f2ac89ca37ce8eb6
Instruction ID: 2e46f73e23541be636e2fd56827ecfc82f60fc1dd3a6790c131fc6ef22eb162e
Opcode Fuzzy Hash: f2ae1f0cd26f95fb7a245857ce5db63d4ae2c4b1855e6f98f2ac89ca37ce8eb6
Instruction Fuzzy Hash: 71510531E00105DFEB24EF78E4546AEB7B2FF84314F208869D906D7291DB399855CBA1

Function 0670FA40 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf31cbcc80b06dd846280c3f46c838e3929a7877a50216db7a41758fd5eb7e4
Instruction ID: 9799cfedf33162ac29c7253d20384b0bf98690c9d84f3be1ae69248c12df2d38
Opcode Fuzzy Hash: 6cf31cbcc80b06dd846280c3f46c838e3929a7877a50216db7a41758fd5eb7e4
Instruction Fuzzy Hash: 1151B674B10215DFFF74666CE95473F669EDB89310F20482AE80AC73E5CA6DCC4687A2

Function 0670FA50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e90ce00b7b09bc917802299dfcb07e23aa51d9985c5119c045bc9e5abd80c5
Instruction ID: 1153dcc9d0b4ca28a65753f6a30d1f4f38dc0036baa89b5b28c687079353996b
Opcode Fuzzy Hash: 30e90ce00b7b09bc917802299dfcb07e23aa51d9985c5119c045bc9e5abd80c5
Instruction Fuzzy Hash: 14518374B10214DBFF746669E95473F669EDB89310F20482AE80AC73E5CA6DCC4687A2

Function 06705418 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df977f3fe7bfeb728c5e69f4fd9c600cc6beb6645ec9820a106a549a9f5b824b
Instruction ID: 37a5f51a22b947d4d51ae18040059ac58c2ee138d9f6484ffb6513b885eef2e9
Opcode Fuzzy Hash: df977f3fe7bfeb728c5e69f4fd9c600cc6beb6645ec9820a106a549a9f5b824b
Instruction Fuzzy Hash: 8E418075E00609DFEF60CEA9D980ABEF7F6EB84310F104926E219D7190D730E9958FA1

Function 06705590 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 035e57f66ae52c13f67477386f4153bfdbaa028f45e36d66deafa1ea167339d5
Instruction ID: 136e3b265741cdd80a82f28d90dfb3967ac55c6b3bfeb165b5de4219058f3f44
Opcode Fuzzy Hash: 035e57f66ae52c13f67477386f4153bfdbaa028f45e36d66deafa1ea167339d5
Instruction Fuzzy Hash: 88419175E10105CBFF708A69CA8077EB7F2EB85710F20892AD559D72C0EA75D842DF61

Function 06702080 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12f1a58ee46f768986d9014019f645699ce5c660b31a363534089efae57f997
Instruction ID: 5ddb8bbb3cb8fde3e2d015844b3c59f219e0eada0e6b2ff4ae10d10759557b42
Opcode Fuzzy Hash: c12f1a58ee46f768986d9014019f645699ce5c660b31a363534089efae57f997
Instruction Fuzzy Hash: 8D318E31E00206DFDB55CF64D858AAEBBF2BF89300F108419E916E7391DB71AD46CBA1

Function 0670D978 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1210d1f6f6c218d449ba498218211121c195ff17a38880dac80e62c92f674b2e
Instruction ID: 621ad33f661838c631d5a40606c22bd218651d4c65cbb00637095f0d6d99c37d
Opcode Fuzzy Hash: 1210d1f6f6c218d449ba498218211121c195ff17a38880dac80e62c92f674b2e
Instruction Fuzzy Hash: 7C316770A1030A9FDF64DFA9D94069EB7F6FF85300F208929E445E7284DB71E946CB51

Function 06702090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a66cce7170ef49facecb3cd0b33114d19644612e765360990005a8bd07ead85
Instruction ID: ba0d072e544caccc93b24bb735455b6d8489acbe696b65badab333cbca539538
Opcode Fuzzy Hash: 7a66cce7170ef49facecb3cd0b33114d19644612e765360990005a8bd07ead85
Instruction Fuzzy Hash: CA319C31E1020ADBDB55CF64C858AAEB7F2FF89300F108529E916E7391DB71AD46CB90

Function 06703EA0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8cf84b36cc216999cb084cb1851b9564bdeea4831f40700499685beab336ed5
Instruction ID: 264edbbe5dea0b4143a52c7ebd711f7a26b4d3385680af505f61631de0ae04c3
Opcode Fuzzy Hash: d8cf84b36cc216999cb084cb1851b9564bdeea4831f40700499685beab336ed5
Instruction Fuzzy Hash: EB216076F106169FDB50DFA9D840AAEBBF5EB48710F108025E909E7381D731D8428BA1

Function 06703EB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b544e04d893bf4f97362cd5151e6c31e6d876296cc780880df194ecc20ceb4
Instruction ID: 4c10bb29be0ed4c8aa6d9d834d9f792ddad5e0eb045307ead2d09ee63457a9de
Opcode Fuzzy Hash: 01b544e04d893bf4f97362cd5151e6c31e6d876296cc780880df194ecc20ceb4
Instruction Fuzzy Hash: C5218376F006169FEB50DFA9D840AAEB7F5EB48710F148025E909E7380D732DD41CB91

Function 00D1D005 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4493595555.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d1d000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60346f1f272510c8062c9d27e9ef6fe00111f16e65abc37dd65484546b2ce46d
Instruction ID: 43d21102326fc3eea7872abf2593028c16cc0f491a58015ce27f212959b2c7b6
Opcode Fuzzy Hash: 60346f1f272510c8062c9d27e9ef6fe00111f16e65abc37dd65484546b2ce46d
Instruction Fuzzy Hash: AB316F7150D3C49FC713CB24D890711BF71AB46214F29C5DBD9898F2A3C33A984ACB62

Function 06706D01 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e637301293f7411adc43c08e6c5c5302734fdb28a8193c9e5caba65794205f9
Instruction ID: a3e7bd51dc4a0cc24616474fdfdf0e17a8e64f24dce42249ae0ae2e576103e53
Opcode Fuzzy Hash: 2e637301293f7411adc43c08e6c5c5302734fdb28a8193c9e5caba65794205f9
Instruction Fuzzy Hash: 0621D430B101159FEF54EA68E8546AEBBF7EB84310F248425E409D7380D732AD568BA1

Function 00D1D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4493595555.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d1d000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788ffb5cd6e3921e4043bbc092204aa54d9a1a377060f4d249f8058fda525e00
Instruction ID: 2fcbf0515094bf6b3a23d5f93ff0a9a93e7c4f6a8752b983a69cb8381d284aa9
Opcode Fuzzy Hash: 788ffb5cd6e3921e4043bbc092204aa54d9a1a377060f4d249f8058fda525e00
Instruction Fuzzy Hash: 8E21F575504204EFCB14DF14E980B66BB66FB88314F24C569E9494B256C73AD886CA72

Function 06703FC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fddfa5635ea08c5537a77d7ff18a9835667e2368e126f16e6025c29d2ca26523
Instruction ID: ebb4e0457f8db913c52a26a533873deaad36056bea74e5e6ed31ef19ef8954ff
Opcode Fuzzy Hash: fddfa5635ea08c5537a77d7ff18a9835667e2368e126f16e6025c29d2ca26523
Instruction Fuzzy Hash: 5D118232B105198FDB54D678C8146AF73EAEBC9251B018579D50AE7384EF26DC068BE2

Function 0670F1A9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d45c27925c0016da422b2cb5f79af99e2b6fc5dab781fb1b408ca98eeb8bccb
Instruction ID: 5f1715e257a285a4f0db09e798c922001817414bce48e41891f2c33415522114
Opcode Fuzzy Hash: 7d45c27925c0016da422b2cb5f79af99e2b6fc5dab781fb1b408ca98eeb8bccb
Instruction Fuzzy Hash: 9601F535B001115FDB71EA7CD850B2E77EADBC6614F10846AE50EC73C1DA2ADD0787A1

Function 06703878 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851044791aa541bb5b441250c574fd28ad2b9bdb05fae4c852d32fd9969cf5ef
Instruction ID: b8cfc58e345d5698ebd6bdecf5bc784b52a1939bd1cb4dd1adace5965720e21b
Opcode Fuzzy Hash: 851044791aa541bb5b441250c574fd28ad2b9bdb05fae4c852d32fd9969cf5ef
Instruction Fuzzy Hash: 3221C3B5D01259AFCB10DF9AD884ADEFFF8FB49310F10812AE918A7240C3756954CBA5

Function 067041F8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b527fca0a9540ac0049f065cde477c3106a3fb8a0625411e9ddd2cb5763aa55a
Instruction ID: 1b4165853228a2b01f9dcbf5b5192bc2e82dbc707ddcfb7636976831f5b1c2c4
Opcode Fuzzy Hash: b527fca0a9540ac0049f065cde477c3106a3fb8a0625411e9ddd2cb5763aa55a
Instruction Fuzzy Hash: 42019E35B041118FEB65DAAD9814B2AA6DACBC6610F10842AE20AC73D9DD61CD0643E1

Function 06703FB0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8df1b5c56fa2c35d65a3151057d907e2b600dc197a9d145e8973088f632574
Instruction ID: 90e71f23501dd3950c600a129820d9370becca1974fcceda3c3a5071d7128820
Opcode Fuzzy Hash: cd8df1b5c56fa2c35d65a3151057d907e2b600dc197a9d145e8973088f632574
Instruction Fuzzy Hash: 3401B536B100159BEB64D5689C14AEF72EBDBC9650F014435E50AE3284EF21D8068BE2

Function 0670A2F8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f7951fc12affe0d01cf9175fa577fb5bd49855c7bd967453d8808bdfcb5826
Instruction ID: fa605349225cb42b333d92740706ddefca4fb4c54b674f104bded3422ad6d843
Opcode Fuzzy Hash: 54f7951fc12affe0d01cf9175fa577fb5bd49855c7bd967453d8808bdfcb5826
Instruction Fuzzy Hash: 00018471B006155FEB609B7CD854B6FB7D6EB8A710F108438E10AC73D5DA22DD438391

Function 06703880 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf3e18bf5d05b81c330815609d5138093cf3e71b963ed1f2588f5d54a6dc4dc
Instruction ID: b6d1f2ca9e9d9f2e0103aa8c798f41a9b907bbb6b5bd0e9772937a8a8c30a078
Opcode Fuzzy Hash: 2bf3e18bf5d05b81c330815609d5138093cf3e71b963ed1f2588f5d54a6dc4dc
Instruction Fuzzy Hash: 8E11D3B1D01259AFCB00DF9AD884ADEFFF4FB49310F10812AE918A7240C374A554CFA5

Function 06704208 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4d8dad7025642ee3dce866496b17d443097522616cbc7c88c7ebaa28e395ae
Instruction ID: d54c5267bd0069c0f017c4fa7695070c9735c2d86205e290d709d4235bc25aeb
Opcode Fuzzy Hash: 8c4d8dad7025642ee3dce866496b17d443097522616cbc7c88c7ebaa28e395ae
Instruction Fuzzy Hash: A3018135B100118BEB64EAADD414B2FA6DBDBCA714F10843AE60EC73D8DA65DD0643E5

Function 0670F1B8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a582f284ca257bcf1f46abf5f6b1062d585a159b917425afe342bbac4aee6193
Instruction ID: ac167771d8f419c167108ce4b41fd29a64782db692253bcd9991413ad9dc98da
Opcode Fuzzy Hash: a582f284ca257bcf1f46abf5f6b1062d585a159b917425afe342bbac4aee6193
Instruction Fuzzy Hash: 87018135B000114BDB75DA6DD854B3E66DADBCA624F108439E50EC73C0EE69DD0747A5

Function 0670A308 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d299e5dbe85cc78bd333a92d3814fee1c17d5f183307dbe009315d288dd08f
Instruction ID: 1ba8a92c16c161d62f582903ffd535cf1b82dd10b1cc9c81944cdab842abe680
Opcode Fuzzy Hash: 68d299e5dbe85cc78bd333a92d3814fee1c17d5f183307dbe009315d288dd08f
Instruction Fuzzy Hash: 2C018131B006158FEB64EA7CD454B2FB7DAEB8A710F108438E10EC7395DA22DD438391

Function 06706469 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4fc39b4f1986608f633c314d309f3c026fab1c3f34959219a4669697c52c4f
Instruction ID: 812815106c180d342a25c90450932a63ba6e9509e605c36a515f47540653caf3
Opcode Fuzzy Hash: 2e4fc39b4f1986608f633c314d309f3c026fab1c3f34959219a4669697c52c4f
Instruction Fuzzy Hash: 70E092B0D15208FFFB50CEB0C919B6A77EDDB42204F1089A5E404C7181E536DE1183B0

Non-executed Functions

Function 06707698 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06707BE4
$]q, xrefs: 06707B45
$]q, xrefs: 067077C5
$]q, xrefs: 06707788
$]q, xrefs: 06707BFA
$]q, xrefs: 06707794
$]q, xrefs: 06707C06
$]q, xrefs: 067077B9
$]q, xrefs: 06707BF0
$]q, xrefs: 06707B51

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 5b454bd58cde3373af9d52c846c579c0f3b39932e1a98f8417b43dc1b4b295fd
Instruction ID: faff6ce0e36621fe8f16048e5f823f06037eb5ad805f98a6e90284b94968bd0a
Opcode Fuzzy Hash: 5b454bd58cde3373af9d52c846c579c0f3b39932e1a98f8417b43dc1b4b295fd
Instruction Fuzzy Hash: 2D122F30E00219CFDB68DF68C994A6EB7F6FF85304F208569D409AB295DB34AD46CF91

Function 0670A928 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 0670AA79
$]q, xrefs: 0670AA2A
$]q, xrefs: 0670AADA
$]q, xrefs: 0670AAE6
$]q, xrefs: 0670AAA4
$]q, xrefs: 0670AA85
$]q, xrefs: 0670AAB0
$]q, xrefs: 0670AA1E

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 2477fc437c6ca3bad351296b79589e655a0a269215afaefc69bffe54c8c99af8
Instruction ID: dd68237b392e339f3e761d345bd9e99437591ad376dcfedcf74aa44ceda3f00c
Opcode Fuzzy Hash: 2477fc437c6ca3bad351296b79589e655a0a269215afaefc69bffe54c8c99af8
Instruction Fuzzy Hash: 3B916F70A10309DFEB68DF68D994B6E77F6EF84304F208529E402972D6DB759D41CBA0

Function 06707098 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 067075AC
$]q, xrefs: 067073E0
$]q, xrefs: 067073D4
.5uq, xrefs: 067070F3
$]q, xrefs: 0670737A
$]q, xrefs: 067075A0
$]q, xrefs: 06707534

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 831cc0ed6d14c4e13bd520f2a2931f44a9aaee2d3380dff64eb368650094ba39
Instruction ID: a7324c39f5d296961a4b8c4d94973dd638440b356ed7a4a29b5e298b2c9d1067
Opcode Fuzzy Hash: 831cc0ed6d14c4e13bd520f2a2931f44a9aaee2d3380dff64eb368650094ba39
Instruction Fuzzy Hash: 45F12F34B01209CFDB58EFA8D954A6EB7F6FF84300F208569D4069B399DB35AC42CB91

Function 067083D0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 0670868F
$]q, xrefs: 0670869B
$]q, xrefs: 06708636
$]q, xrefs: 0670862A

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 3a4f4c2a51f1ddee2cad8545c5a7c17ebf24cac63fb380b4a3cf9c7125a6a67d
Instruction ID: 81635f3d7546c4908c30b681a2cb6c6b0962a552a5cd0687756458650681137d
Opcode Fuzzy Hash: 3a4f4c2a51f1ddee2cad8545c5a7c17ebf24cac63fb380b4a3cf9c7125a6a67d
Instruction Fuzzy Hash: 63B12C30B11209CFEB54DFA8C99466EB7F6EF84304F248429D4069B395DB75DC86CBA1

Function 067087E8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 0670892A
$]q, xrefs: 06708867
LR]q, xrefs: 067088DB
$]q, xrefs: 06708873

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: d2171b8ff2e1e9b8c1398ee14e0596772200340e0afb7515794ac16c96111799
Instruction ID: 2e94445ae26799266161499fa4e58a9fa1323ce3f650680e4fe91ebde7c3cba7
Opcode Fuzzy Hash: d2171b8ff2e1e9b8c1398ee14e0596772200340e0afb7515794ac16c96111799
Instruction Fuzzy Hash: 9C516F30B10205DFEB58EF68D950A6A77F6FF85300B148569E4069B3E5DB31EC41CBA6

Function 0670ACB0 Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

$]q, xrefs: 0670AE63
$]q, xrefs: 0670AE8C
$]q, xrefs: 0670AE34
$]q, xrefs: 0670ADE1

Memory Dump Source

Source File: 00000005.00000002.4501360476.0000000006700000.00000040.00000800.00020000.00000000.sdmp, Offset: 06700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6700000_ynhHNexysa.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: f70ab056aa4a07b9a970045e104a772b577dbce48887b25ca3d396068625bebc
Instruction ID: 83c50d55b0bed375ff3d9ec00778632cf24b190ac46cb9283574337176007d03
Opcode Fuzzy Hash: f70ab056aa4a07b9a970045e104a772b577dbce48887b25ca3d396068625bebc
Instruction Fuzzy Hash: B2518130A10305DFEF65DB68D980AAE77F6EF84310F248529E80697396DB35DD42CBA0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ynhHNexysa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ynhHNexysa.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
ynhHNexysa.exe

Function 05637BD0 Relevance: 43.2, Strings: 33, Instructions: 1941
COMMON

Function 05637BC0 Relevance: 43.2, Strings: 33, Instructions: 1931
COMMON

Function 076079B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 249
processCOMMON

Function 076079C0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Function 056318E5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115
COMMON

Function 056318F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
COMMON

Function 0162AD48 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMON

Function 016244D4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Function 016258EC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Function 05634050 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre