Edit tour

Windows Analysis Report
SGn3RtDC8Y.exe

Overview

General Information

Sample name:	SGn3RtDC8Y.exe
Analysis ID:	1488266
MD5:	3ca2945c2c97310afef97e0c889cb8ec
SHA1:	8c966c390528be4c4212106e9a7e235bf628f269
SHA256:	4f14009eb3fcc7dae430cce6bb1a0a830adda753d234d3621cee0014d686321e
Tags:	exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Yara signature match

Classification

Process Tree

System is w10x64

SGn3RtDC8Y.exe (PID: 7444 cmdline: "C:\Users\user\Desktop\SGn3RtDC8Y.exe" MD5: 3CA2945C2C97310AFEF97E0C889CB8EC)

cmd.exe (PID: 7560 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jlxopxf\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7616 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ubezyssm.exe" C:\Windows\SysWOW64\jlxopxf\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7672 cmdline: "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7732 cmdline: "C:\Windows\System32\sc.exe" description jlxopxf "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7788 cmdline: "C:\Windows\System32\sc.exe" start jlxopxf MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7864 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7968 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 1200 MD5: C31336C1EFC2CCB44B4326EA793040F2)

ubezyssm.exe (PID: 7844 cmdline: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d"C:\Users\user\Desktop\SGn3RtDC8Y.exe" MD5: 32F0C83846CE2CC1E5F9549AE158AD56)

svchost.exe (PID: 8000 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 8036 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7844 -s 540 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7872 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7936 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7444 -ip 7444 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8008 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7844 -ip 7844 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7264 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.1461743704.0000000002942000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x515a:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.1443238821.0000000002BF9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4f72:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: SGn3RtDC8Y.exe PID: 7444	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: ubezyssm.exe PID: 7844	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 8000	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.3.ubezyssm.exe.2910000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.ubezyssm.exe.2910000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.SGn3RtDC8Y.exe.29b0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.SGn3RtDC8Y.exe.29b0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.SGn3RtDC8Y.exe.29b0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.ubezyssm.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.ubezyssm.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.ubezyssm.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.ubezyssm.exe.2910000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.ubezyssm.exe.2910000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.ubezyssm.exe.2910000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.ubezyssm.exe.2910000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.ubezyssm.exe.2910000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.ubezyssm.exe.2910000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.SGn3RtDC8Y.exe.29e0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.SGn3RtDC8Y.exe.29e0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.ubezyssm.exe.28f0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.ubezyssm.exe.28f0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.ubezyssm.exe.28f0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.ubezyssm.exe.28f0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.ubezyssm.exe.28f0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.ubezyssm.exe.2910000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.ubezyssm.exe.2910000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.ubezyssm.exe.2910000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.SGn3RtDC8Y.exe.29b0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.SGn3RtDC8Y.exe.29b0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
18.2.svchost.exe.470000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.svchost.exe.470000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
18.2.svchost.exe.470000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.SGn3RtDC8Y.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.SGn3RtDC8Y.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.SGn3RtDC8Y.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.ubezyssm.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.ubezyssm.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.ubezyssm.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.SGn3RtDC8Y.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.SGn3RtDC8Y.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.SGn3RtDC8Y.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
18.2.svchost.exe.470000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.svchost.exe.470000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
18.2.svchost.exe.470000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d"C:\Users\user\Desktop\SGn3RtDC8Y.exe", ParentImage: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, ParentProcessId: 7844, ParentProcessName: ubezyssm.exe, ProcessCommandLine: svchost.exe, ProcessId: 8000, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\SGn3RtDC8Y.exe", ParentImage: C:\Users\user\Desktop\SGn3RtDC8Y.exe, ParentProcessId: 7444, ParentProcessName: SGn3RtDC8Y.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7672, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.11.0, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 8000, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d"C:\Users\user\Desktop\SGn3RtDC8Y.exe", ParentImage: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, ParentProcessId: 7844, ParentProcessName: ubezyssm.exe, ProcessCommandLine: svchost.exe, ProcessId: 8000, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 8000, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\jlxopxf

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\SGn3RtDC8Y.exe", ParentImage: C:\Users\user\Desktop\SGn3RtDC8Y.exe, ParentProcessId: 7444, ParentProcessName: SGn3RtDC8Y.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7672, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 7872, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: jotunheim.name:443	Avira URL Cloud: Label: malware
Source: vanaheim.cn:443	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ubezyssm.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SGn3RtDC8Y.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Unpacked PE file: 0.2.SGn3RtDC8Y.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Unpacked PE file: 12.2.ubezyssm.exe.400000.0.unpack

Source: SGn3RtDC8Y.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\jlxopxf

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.106 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.226.112.95 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.251.168.26 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.11.0 52.101.11.0
Source: Joe Sandbox View	IP Address: 67.195.228.106 67.195.228.106
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: YAHOO-GQ1US YAHOO-GQ1US
Source: Joe Sandbox View	ASN Name: RETN-ASEU RETN-ASEU
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU

Source: global traffic	TCP traffic: 192.168.2.8:49706 -> 52.101.11.0:25
Source: global traffic	TCP traffic: 192.168.2.8:49710 -> 67.195.228.106:25
Source: global traffic	TCP traffic: 192.168.2.8:57233 -> 142.251.168.26:25
Source: global traffic	TCP traffic: 192.168.2.8:57237 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta6.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57236
Source: unknown	Network traffic detected: HTTP traffic on port 57238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57238
Source: unknown	Network traffic detected: HTTP traffic on port 57236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.2910000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.ubezyssm.exe.2910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.28f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.2910000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SGn3RtDC8Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SGn3RtDC8Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SGn3RtDC8Y.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ubezyssm.exe PID: 7844, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8000, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.3.ubezyssm.exe.2910000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.ubezyssm.exe.2910000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.ubezyssm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.ubezyssm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.ubezyssm.exe.2910000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.ubezyssm.exe.2910000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.ubezyssm.exe.2910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.ubezyssm.exe.2910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.SGn3RtDC8Y.exe.29e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.SGn3RtDC8Y.exe.29e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.ubezyssm.exe.28f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.ubezyssm.exe.28f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.ubezyssm.exe.28f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.ubezyssm.exe.28f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.ubezyssm.exe.2910000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.ubezyssm.exe.2910000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 18.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 18.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.SGn3RtDC8Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.SGn3RtDC8Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.ubezyssm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.ubezyssm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.SGn3RtDC8Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.SGn3RtDC8Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 18.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 18.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.1461743704.0000000002942000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.1443238821.0000000002BF9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\jlxopxf\

Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_0047C913	18_2_0047C913

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Code function: String function: 029B27AB appears 35 times
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7444 -ip 7444

Source: SGn3RtDC8Y.exe, 00000000.00000000.1384351438.000000000282C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOdilesigo: vs SGn3RtDC8Y.exe
Source: SGn3RtDC8Y.exe, 00000000.00000002.1443278454.0000000002CAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesc.exej% vs SGn3RtDC8Y.exe
Source: SGn3RtDC8Y.exe, 00000000.00000002.1443278454.0000000002C5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesOdilesigo: vs SGn3RtDC8Y.exe
Source: SGn3RtDC8Y.exe	Binary or memory string: OriginalFilenamesOdilesigo: vs SGn3RtDC8Y.exe

Source: SGn3RtDC8Y.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.3.ubezyssm.exe.2910000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.ubezyssm.exe.2910000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.ubezyssm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.ubezyssm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.ubezyssm.exe.2910000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.ubezyssm.exe.2910000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.ubezyssm.exe.2910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.ubezyssm.exe.2910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.SGn3RtDC8Y.exe.29e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.SGn3RtDC8Y.exe.29e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.ubezyssm.exe.28f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.ubezyssm.exe.28f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.ubezyssm.exe.28f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.ubezyssm.exe.28f0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.ubezyssm.exe.2910000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.ubezyssm.exe.2910000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 18.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 18.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.SGn3RtDC8Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.SGn3RtDC8Y.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.ubezyssm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.ubezyssm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.SGn3RtDC8Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.SGn3RtDC8Y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 18.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 18.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.1461743704.0000000002942000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.1443238821.0000000002BF9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: SGn3RtDC8Y.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@32/3@9/5

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_02BFDFA0 CreateToolhelp32Snapshot,Module32First,

0_2_02BFDFA0

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_00479A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	18_2_00479A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:8008:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7796:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7936:64:WilError_03

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

File created: C:\Users\user\AppData\Local\Temp\ubezyssm.exe

Jump to behavior

Source: SGn3RtDC8Y.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

File read: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Jump to behavior

Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_12-14492
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_0-14320

Source: unknown	Process created: C:\Users\user\Desktop\SGn3RtDC8Y.exe "C:\Users\user\Desktop\SGn3RtDC8Y.exe"
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jlxopxf\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ubezyssm.exe" C:\Windows\SysWOW64\jlxopxf\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description jlxopxf "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start jlxopxf
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d"C:\Users\user\Desktop\SGn3RtDC8Y.exe"
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7444 -ip 7444
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 1200
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7844 -ip 7844
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7844 -s 540
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jlxopxf\	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ubezyssm.exe" C:\Windows\SysWOW64\jlxopxf\	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description jlxopxf "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start jlxopxf	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7444 -ip 7444	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 1200	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7844 -ip 7844	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7844 -s 540	Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: SGn3RtDC8Y.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Unpacked PE file: 0.2.SGn3RtDC8Y.exe.400000.0.unpack .text:ER;.data:W;.xevaj:R;.zac:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Unpacked PE file: 12.2.ubezyssm.exe.400000.0.unpack .text:ER;.data:W;.xevaj:R;.zac:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Unpacked PE file: 0.2.SGn3RtDC8Y.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Unpacked PE file: 12.2.ubezyssm.exe.400000.0.unpack

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: SGn3RtDC8Y.exe	Static PE information: section name: .xevaj
Source: SGn3RtDC8Y.exe	Static PE information: section name: .zac

Source: SGn3RtDC8Y.exe

Static PE information: section name: .text entropy: 7.252737791491828

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe (copy)			Jump to dropped file
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	File created: C:\Users\user\AppData\Local\Temp\ubezyssm.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\jlxopxf

Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\sgn3rtdc8y.exe

Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

18_2_0047199C

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-14753
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_18-7518
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-14916

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_18-6061

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-14760
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-14873
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_18-6345

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_0-14560
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-14507
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_18-7336

Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_12-14509
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-14337

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	API coverage: 5.6 %
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	API coverage: 4.1 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 8044	Thread sleep count: 36 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 8044	Thread sleep time: -36000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000012.00000002.2648229643.0000000000800000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	API call chain: ExitProcess graph end node			graph_0-14764
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	API call chain: ExitProcess graph end node			graph_12-14877

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe

Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep

graph_18-7580

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Code function: 0_2_029B0D90 mov eax, dword ptr fs:[00000030h]	0_2_029B0D90
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Code function: 0_2_029B092B mov eax, dword ptr fs:[00000030h]	0_2_029B092B
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Code function: 0_2_02BFD87D push dword ptr fs:[00000030h]	0_2_02BFD87D
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Code function: 12_2_028F0D90 mov eax, dword ptr fs:[00000030h]	12_2_028F0D90
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Code function: 12_2_028F092B mov eax, dword ptr fs:[00000030h]	12_2_028F092B
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Code function: 12_2_02946A65 push dword ptr fs:[00000030h]	12_2_02946A65

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_00479A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	18_2_00479A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.106 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.226.112.95 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.251.168.26 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 470000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 470000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 470000			Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2EF008			Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jlxopxf\	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ubezyssm.exe" C:\Windows\SysWOW64\jlxopxf\	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description jlxopxf "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start jlxopxf	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7444 -ip 7444	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 1200	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7844 -ip 7844	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7844 -s 540	Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

0_2_00407809

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.2910000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.ubezyssm.exe.2910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.28f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.2910000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SGn3RtDC8Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SGn3RtDC8Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SGn3RtDC8Y.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ubezyssm.exe PID: 7844, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8000, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 0.3.SGn3RtDC8Y.exe.29e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SGn3RtDC8Y.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.2910000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.ubezyssm.exe.2910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.28f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.2910000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SGn3RtDC8Y.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ubezyssm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SGn3RtDC8Y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SGn3RtDC8Y.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ubezyssm.exe PID: 7844, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8000, type: MEMORYSTR

Source: C:\Users\user\Desktop\SGn3RtDC8Y.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_004788B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	18_2_004788B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	22 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SGn3RtDC8Y.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\ubezyssm.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
jotunheim.name:443	100%	Avira URL Cloud	malware
vanaheim.cn:443	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mta6.am0.yahoodns.net	67.195.228.106	true	true	unknown
mxs.mail.ru	217.69.139.150	true	true	unknown
microsoft-com.mail.protection.outlook.com	52.101.11.0	true	true	unknown
vanaheim.cn	213.226.112.95	true	true	unknown
smtp.google.com	142.251.168.26	true	false	unknown
google.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.11.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
67.195.228.106	mta6.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	true
213.226.112.95	vanaheim.cn	Russian Federation	9002	RETN-ASEU	true
142.251.168.26	smtp.google.com	United States	15169	GOOGLEUS	false
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488266
Start date and time:	2024-08-05 19:37:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SGn3RtDC8Y.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@32/3@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 63 Number of non-executed functions: 262
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.76.201.171, 20.70.246.20, 20.231.239.246, 20.112.250.133, 20.236.44.162
Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, ocsp.digicert.com, slscr.update.microsoft.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SGn3RtDC8Y.exe

Simulations

Behavior and APIs

Time	Type	Description
13:38:49	API Interceptor	9x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.11.0	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse
67.195.228.106	file.exe	Get hash	malicious	Phorpiex	Browse
	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	Update-KB6734-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse
	DWVByMCYL8.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse
	HsWJJz7nq4.exe	Get hash	malicious	Tofsee Xmrig	Browse
	ac492e6a204784df07ef3841b3ae1f8a68b349db90a34.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse
	body.elm.exe	Get hash	malicious	Unknown	Browse
213.226.112.95	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
217.69.139.150	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
microsoft-com.mail.protection.outlook.com	.exe	Get hash	malicious	Unknown	Browse	52.101.40.26
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	setup.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
mta6.am0.yahoodns.net	.exe	Get hash	malicious	Unknown	Browse	98.136.96.76
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	67.195.204.73
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	67.195.204.74
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	98.136.96.75
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.72
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	67.195.228.109
vanaheim.cn	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	setup.exe	Get hash	malicious	Tofsee	Browse	185.218.0.41
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	62.76.228.127
mxs.mail.ru	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	setup.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	94.100.180.31
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RETN-ASEU	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	http://baghoorg.xyz	Get hash	malicious	Unknown	Browse	139.45.197.153
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	139.45.197.236
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	139.45.197.236
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	https://ky.codzika.xyz/pubg/	Get hash	malicious	Unknown	Browse	139.45.197.250
	https://plcr.com.ng/atm.php?user=21003&ref=21003	Get hash	malicious	Unknown	Browse	139.45.197.237
	http://becast.onionlive.workers.dev	Get hash	malicious	Unknown	Browse	139.45.197.236
	http://thampolsi.com	Get hash	malicious	Unknown	Browse	139.45.197.244
MAILRU-ASMailRuRU	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	SecuriteInfo.com.Trojan.Crypt.28917.30010.exe	Get hash	malicious	Unknown	Browse	5.61.236.163
	IISz6QDXkY.elf	Get hash	malicious	Mirai	Browse	5.61.23.77
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	7Y18r(123).exe	Get hash	malicious	Unknown	Browse	94.100.180.106
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	setup.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SecuriteInfo.com.W32.Kryptik.CI.tr.21358.1519.exe	Get hash	malicious	Unknown	Browse	5.61.236.163
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	79.137.247.12
	SIP.03746.XSLSX.exe	Get hash	malicious	Unknown	Browse	217.69.139.160
MICROSOFT-CORP-MSN-AS-BLOCKUS	BWISE Solution #24-2000091.pdf	Get hash	malicious	Unknown	Browse	52.146.76.30
	https://www.templatent.com/eur/53d926b2-0373-4a76-8641-e3f5488f632d/768e4d81-78b7-4fd9-a857-c5bae5c87179/8806a07c-707c-445d-b36c-c08aabe89fc9/login?id=eHZ4eG45M1NGWG40b2QvVmpHbE5UdUJZSWtJNTkrbE9YcjlKZERpV1VUZ3Zlbk5sM3MwTWYzMjJ0ZWpYb2VpekdKaCtMclNhd3hFRDdtd2VKSi9HM3M2bDFHRkdDd0YrdW1DNWlqTFQwc1BRd0Y5Q0lDZ0tLdys2RHVCZ2NXemVQUDdZa0laUFJlbFJsTnlkdWZsUHR4SnVUV2pZN3QyNkJXaDJSeEdWN3JJT2hHaUYwd2xqMmJ4Y05kSSsxU0ppVkc5QURXSkJKUlMxNEgvT0FIWUQvWGZFZHBvbFdhcVBXRzQxWnJ3M0RwMElNQkpsaWtXWGRMV3Y1ZHNmREVCMkxVa05HeW1qb1BSRkMrSmxpNS80Z2FWaGtJZWthYXZ6WWtaeGNIWjU5VitKZ1Vzd1pHN0VyOTJqTDFvZUYvTURlWUdvRysxd0dZZjgySXduSXM2enIwWDlmWWsxcTk2L1BvV1dGZERCcUxHazluS0kwRU9oK3lKKzJPeFU1NDRVN2N2ZVhPRHRDb3k2c1ZyTkdlR2YyUT09	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://grace-barr.filemail.com/t/Fc9Dus5d	Get hash	malicious	HTMLPhisher	Browse	52.98.241.162
	001original.eml	Get hash	malicious	Unknown	Browse	104.208.16.91
	Saic Benefits_Enrollment.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	FW Quote.msg	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
	https://thehackernews.com/2024/08/new-android-trojan-blankbot-targets.html	Get hash	malicious	Unknown	Browse	13.107.246.60
	Tax_List1.accde	Get hash	malicious	Unknown	Browse	104.208.16.88
	2v5GEWkdGs.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.60
	RoeyfVUJc5.exe	Get hash	malicious	AgentTesla	Browse	13.107.253.72
YAHOO-GQ1US	.exe	Get hash	malicious	Unknown	Browse	67.195.228.84
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	98.137.77.194
	qD7cj0t7Ag.elf	Get hash	malicious	Mirai, Moobot	Browse	98.137.186.234
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	https://yellatism.com/click.php?key=2240o76mk7oyoycyr074&cid=cphbldi9sch0sh7da130&zone=2353135-2517555085-3576986712&campaign=395161020&type=Push&age=11&creative_id=547520&campaign_id=108855&site_id=11517&placement_id=43113822&preset_id=500	Get hash	malicious	Unknown	Browse	98.137.11.164
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	GK9sEyIS4f.elf	Get hash	malicious	Mirai	Browse	98.136.201.234
	n6UMcur8v3.elf	Get hash	malicious	Mirai	Browse	98.137.238.181
	zGP5DlrwgZ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.137.103.190

Process:	C:\Users\user\Desktop\SGn3RtDC8Y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12340224
Entropy (8bit):	4.718126448713269
Encrypted:	false
SSDEEP:	24576:ZIbasG14OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOv:ZItG1
MD5:	32F0C83846CE2CC1E5F9549AE158AD56
SHA1:	3C147F1AF0077F1AB901F2B0875C36CF034ECE52
SHA-256:	9FF2FE5E4C2CFCC0871FB897E5D315732B8E25CEABC60D14644E59D734D033EB
SHA-512:	62ABF9946C131B9921791CAA39070193C0B24363738A4E08C8232F70EA958B880B13275112B887513B0CE67403AE5B67F0A18FC4A04E5E53C226A5750E2C261F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*~TQK..QK..QK..>=..rK..>=..pK..>=...K..X3..VK..QK..-K..>=..PK..>=..PK..>=..PK..RichQK..........PE..L....".d......................A......[............@..........................`C.....Ta.........................................P.....B.............................................................A..@............................................text...0........................... ..`.data...T.?......\|..................@....xevaj........B......0..............@..@.zac..........B......4..............@....rsrc........B......8..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12340224
Entropy (8bit):	4.718126448713269
Encrypted:	false
SSDEEP:	24576:ZIbasG14OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOv:ZItG1
MD5:	32F0C83846CE2CC1E5F9549AE158AD56
SHA1:	3C147F1AF0077F1AB901F2B0875C36CF034ECE52
SHA-256:	9FF2FE5E4C2CFCC0871FB897E5D315732B8E25CEABC60D14644E59D734D033EB
SHA-512:	62ABF9946C131B9921791CAA39070193C0B24363738A4E08C8232F70EA958B880B13275112B887513B0CE67403AE5B67F0A18FC4A04E5E53C226A5750E2C261F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*~TQK..QK..QK..>=..rK..>=..pK..>=...K..X3..VK..QK..-K..>=..PK..>=..PK..>=..PK..RichQK..........PE..L....".d......................A......[............@..........................`C.....Ta.........................................P.....B.............................................................A..@............................................text...0........................... ..`.data...T.?......\|..................@....xevaj........B......0..............@..@.zac..........B......4..............@....rsrc........B......8..............@..@........................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.264917271787961
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SGn3RtDC8Y.exe
File size:	315'904 bytes
MD5:	3ca2945c2c97310afef97e0c889cb8ec
SHA1:	8c966c390528be4c4212106e9a7e235bf628f269
SHA256:	4f14009eb3fcc7dae430cce6bb1a0a830adda753d234d3621cee0014d686321e
SHA512:	1ddae2b47e39ed822e063bd749e6d51c4a815239bf3fbe222a4cccdfd681d419427bf28ad19c26efec3bc72b840f92de05663848b7dd7ec77bc817ee2220655c
SSDEEP:	3072:450fnzC44jWJ5jj0GpS9bfyZ2RG0xacKyPssuQXF5aM5S1FjVQq2T0:jPzjR5X0G4bf62VxUHsuQCMg1FJQq2T
TLSH:	9D64BF2172A0C071D5A717344874D7BE6A7EB863B774808B37986B7F6E303812AB175E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*~TQK..QK..QK..>=..rK..>=..pK..>=...K..X3..VK..QK..-K..>=..PK..>=..PK..>=..PK..RichQK..........PE..L....".d...................

File Icon


Icon Hash:	cd4d3d2e4e054d07

Static PE Info

General

Entrypoint:	0x405b8d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x641022E1 [Tue Mar 14 07:31:45 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	b06a0c09a322281148d5729ca5d14149

Entrypoint Preview

Instruction
call 00007F149940C03Fh
jmp 00007F14994075AEh
int3
int3
int3
int3
int3
int3
int3
int3
int3
call 00007F149940775Ch
xchg cl, ch
jmp 00007F1499407744h
call 00007F1499407753h
fxch st(0), st(1)
jmp 00007F149940773Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007F1499407731h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007F1499407726h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007F1499407724h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007F1499407727h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007F149940813Fh
fstp st(0)
fld tbyte ptr [00401C6Ah]
ret
fstp st(0)
or cl, cl
je 00007F149940772Dh
fstp st(0)
fldpi
or ch, ch
je 00007F1499407724h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007F1499407719h
fchs
ret
fstp st(0)
jmp 00007F1499408115h
fstp st(0)
mov cl, ch
jmp 00007F1499407722h
call 00007F14994076EEh
jmp 00007F1499408120h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
add esp, 00000000h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b4c8	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x242c000	0x98e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2b518	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x41e8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1d4	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2af30	0x2b000	207b2dcd8ee9c04e6e9ebd7b8e1dca7a	False	0.731956304505814	data	7.252737791491828	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2c000	0x23fd754	0x17c00	4ed0a0848cf99f853787caf138c78996	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.xevaj	0x242a000	0x2d3	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.zac	0x242b000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x242c000	0x98e8	0x9a00	8616ee7d72974b73d186ce4629b49ff0	False	0.4296875	data	4.694510365723179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2432c98	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x2433b40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x24343e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x242c420	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.4728144989339019
RT_ICON	0x242c420	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.4728144989339019
RT_ICON	0x242d2c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5870938628158845
RT_ICON	0x242d2c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5870938628158845
RT_ICON	0x242db70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6486175115207373
RT_ICON	0x242db70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6486175115207373
RT_ICON	0x242e238	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.7001445086705202
RT_ICON	0x242e238	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.7001445086705202
RT_ICON	0x242e7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.37022821576763487
RT_ICON	0x242e7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.37022821576763487
RT_ICON	0x2430d48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.46364915572232646
RT_ICON	0x2430d48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.46364915572232646
RT_ICON	0x2431df0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.5413934426229509
RT_ICON	0x2431df0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.5413934426229509
RT_ICON	0x2432778	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.6356382978723404
RT_ICON	0x2432778	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.6356382978723404
RT_STRING	0x2434bb8	0x446	data	Tamil	India	0.45429616087751373
RT_STRING	0x2434bb8	0x446	data	Tamil	Sri Lanka	0.45429616087751373
RT_STRING	0x2435000	0x28e	data	Tamil	India	0.481651376146789
RT_STRING	0x2435000	0x28e	data	Tamil	Sri Lanka	0.481651376146789
RT_STRING	0x2435290	0x658	data	Tamil	India	0.42980295566502463
RT_STRING	0x2435290	0x658	data	Tamil	Sri Lanka	0.42980295566502463
RT_ACCELERATOR	0x2432c58	0x40	data	Tamil	India	0.875
RT_ACCELERATOR	0x2432c58	0x40	data	Tamil	Sri Lanka	0.875
RT_GROUP_CURSOR	0x2434950	0x30	data			0.9375
RT_GROUP_ICON	0x2432be0	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x2432be0	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_VERSION	0x2434980	0x234	data			0.526595744680851

Imports

DLL	Import
KERNEL32.dll	CreateNamedPipeW, GetConsoleAliasesA, GetNumberFormatA, EnumTimeFormatsA, GetConsoleCP, GlobalAlloc, SetFileShortNameW, LoadLibraryW, FatalAppExitW, CreateEventA, GetConsoleAliasW, HeapValidate, ReplaceFileW, GetModuleFileNameW, GetSystemDirectoryA, GlobalUnlock, CreateJobObjectA, LCMapStringA, GetLastError, SetLastError, GetProcAddress, IsBadHugeWritePtr, CreateJobSet, LoadLibraryA, GetTickCount, SetConsoleCtrlHandler, AddAtomW, QueryDosDeviceW, HeapWalk, SetEnvironmentVariableA, GetOEMCP, GetModuleHandleA, GetProcessShutdownParameters, EnumResourceNamesA, RequestWakeupLatency, EnumDateFormatsW, PeekConsoleInputA, GetDiskFreeSpaceExA, GetCurrentProcessId, GetProcessHeap, SetEndOfFile, GetStringTypeW, LCMapStringW, MultiByteToWideChar, WriteConsoleW, GetModuleHandleW, GetConsoleAliasesLengthW, CreateFileA, CreateFileMappingA, EnumResourceNamesW, HeapReAlloc, GetCommandLineA, HeapSetInformation, GetStartupInfoW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, TerminateProcess, GetCurrentProcess, HeapAlloc, HeapFree, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, RtlUnwind, SetFilePointer, HeapCreate, CloseHandle, RaiseException, ExitProcess, WriteFile, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetSystemTimeAsFileTime, Sleep, GetConsoleMode, GetCPInfo, GetACP, IsValidCodePage, ReadFile, SetStdHandle, FlushFileBuffers, HeapSize, CreateFileW
USER32.dll	ChangeMenuA, GetDC, DrawStateA, CharUpperBuffA, GetMenuState, GetCaretPos, GetSysColorBrush, GetComboBoxInfo, SetCaretPos
GDI32.dll	GetCharWidthI, CreateDCA, CreateDCW, GetCharWidthW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 19:38:07.798782110 CEST	49706	25	192.168.2.8	52.101.11.0
Aug 5, 2024 19:38:08.808866024 CEST	49706	25	192.168.2.8	52.101.11.0
Aug 5, 2024 19:38:10.709433079 CEST	49707	443	192.168.2.8	213.226.112.95
Aug 5, 2024 19:38:10.709475994 CEST	443	49707	213.226.112.95	192.168.2.8
Aug 5, 2024 19:38:10.709569931 CEST	49707	443	192.168.2.8	213.226.112.95
Aug 5, 2024 19:38:10.808978081 CEST	49706	25	192.168.2.8	52.101.11.0
Aug 5, 2024 19:38:14.808959007 CEST	49706	25	192.168.2.8	52.101.11.0
Aug 5, 2024 19:38:22.824601889 CEST	49706	25	192.168.2.8	52.101.11.0
Aug 5, 2024 19:38:27.812928915 CEST	49710	25	192.168.2.8	67.195.228.106
Aug 5, 2024 19:38:28.824659109 CEST	49710	25	192.168.2.8	67.195.228.106
Aug 5, 2024 19:38:30.824568987 CEST	49710	25	192.168.2.8	67.195.228.106
Aug 5, 2024 19:38:34.824673891 CEST	49710	25	192.168.2.8	67.195.228.106
Aug 5, 2024 19:38:42.824698925 CEST	49710	25	192.168.2.8	67.195.228.106
Aug 5, 2024 19:38:47.845360994 CEST	57233	25	192.168.2.8	142.251.168.26
Aug 5, 2024 19:38:48.855887890 CEST	57233	25	192.168.2.8	142.251.168.26
Aug 5, 2024 19:38:50.700011015 CEST	49707	443	192.168.2.8	213.226.112.95
Aug 5, 2024 19:38:50.700084925 CEST	443	49707	213.226.112.95	192.168.2.8
Aug 5, 2024 19:38:50.700149059 CEST	49707	443	192.168.2.8	213.226.112.95
Aug 5, 2024 19:38:50.812700033 CEST	57236	443	192.168.2.8	213.226.112.95
Aug 5, 2024 19:38:50.812738895 CEST	443	57236	213.226.112.95	192.168.2.8
Aug 5, 2024 19:38:50.812803030 CEST	57236	443	192.168.2.8	213.226.112.95
Aug 5, 2024 19:38:50.871539116 CEST	57233	25	192.168.2.8	142.251.168.26
Aug 5, 2024 19:38:54.871682882 CEST	57233	25	192.168.2.8	142.251.168.26
Aug 5, 2024 19:39:02.890944004 CEST	57233	25	192.168.2.8	142.251.168.26
Aug 5, 2024 19:39:07.875880003 CEST	57237	25	192.168.2.8	217.69.139.150
Aug 5, 2024 19:39:08.887248039 CEST	57237	25	192.168.2.8	217.69.139.150
Aug 5, 2024 19:39:10.902874947 CEST	57237	25	192.168.2.8	217.69.139.150
Aug 5, 2024 19:39:14.918591976 CEST	57237	25	192.168.2.8	217.69.139.150
Aug 5, 2024 19:39:22.918617964 CEST	57237	25	192.168.2.8	217.69.139.150
Aug 5, 2024 19:39:30.825325966 CEST	57236	443	192.168.2.8	213.226.112.95
Aug 5, 2024 19:39:30.825402021 CEST	443	57236	213.226.112.95	192.168.2.8
Aug 5, 2024 19:39:30.825458050 CEST	57236	443	192.168.2.8	213.226.112.95
Aug 5, 2024 19:39:30.935359955 CEST	57238	443	192.168.2.8	213.226.112.95
Aug 5, 2024 19:39:30.935401917 CEST	443	57238	213.226.112.95	192.168.2.8
Aug 5, 2024 19:39:30.935488939 CEST	57238	443	192.168.2.8	213.226.112.95

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 19:38:07.537410021 CEST	64300	53	192.168.2.8	1.1.1.1
Aug 5, 2024 19:38:07.797939062 CEST	53	64300	1.1.1.1	192.168.2.8
Aug 5, 2024 19:38:10.512768984 CEST	60578	53	192.168.2.8	1.1.1.1
Aug 5, 2024 19:38:10.708720922 CEST	53	60578	1.1.1.1	192.168.2.8
Aug 5, 2024 19:38:27.794228077 CEST	63138	53	192.168.2.8	1.1.1.1
Aug 5, 2024 19:38:27.801183939 CEST	53	63138	1.1.1.1	192.168.2.8
Aug 5, 2024 19:38:27.801959991 CEST	52766	53	192.168.2.8	1.1.1.1
Aug 5, 2024 19:38:27.812226057 CEST	53	52766	1.1.1.1	192.168.2.8
Aug 5, 2024 19:38:47.504132986 CEST	53	62373	162.159.36.2	192.168.2.8
Aug 5, 2024 19:38:47.825210094 CEST	58995	53	192.168.2.8	1.1.1.1
Aug 5, 2024 19:38:47.834175110 CEST	53	58995	1.1.1.1	192.168.2.8
Aug 5, 2024 19:38:47.834889889 CEST	50947	53	192.168.2.8	1.1.1.1
Aug 5, 2024 19:38:47.844665051 CEST	53	50947	1.1.1.1	192.168.2.8
Aug 5, 2024 19:38:48.017450094 CEST	53	59394	1.1.1.1	192.168.2.8
Aug 5, 2024 19:39:07.856681108 CEST	57316	53	192.168.2.8	1.1.1.1
Aug 5, 2024 19:39:07.866209984 CEST	53	57316	1.1.1.1	192.168.2.8
Aug 5, 2024 19:39:07.867010117 CEST	57838	53	192.168.2.8	1.1.1.1
Aug 5, 2024 19:39:07.875178099 CEST	53	57838	1.1.1.1	192.168.2.8
Aug 5, 2024 19:40:06.855220079 CEST	61861	53	192.168.2.8	1.1.1.1
Aug 5, 2024 19:40:06.893662930 CEST	53	61861	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 19:38:07.537410021 CEST	192.168.2.8	1.1.1.1	0x17c	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:10.512768984 CEST	192.168.2.8	1.1.1.1	0x47f8	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:27.794228077 CEST	192.168.2.8	1.1.1.1	0xe0fd	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:38:27.801959991 CEST	192.168.2.8	1.1.1.1	0xd782	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:47.825210094 CEST	192.168.2.8	1.1.1.1	0x2534	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:38:47.834889889 CEST	192.168.2.8	1.1.1.1	0xc10d	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:39:07.856681108 CEST	192.168.2.8	1.1.1.1	0xbf98	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:39:07.867010117 CEST	192.168.2.8	1.1.1.1	0xaa51	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:40:06.855220079 CEST	192.168.2.8	1.1.1.1	0x8aba	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 19:38:07.797939062 CEST	1.1.1.1	192.168.2.8	0x17c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:07.797939062 CEST	1.1.1.1	192.168.2.8	0x17c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:07.797939062 CEST	1.1.1.1	192.168.2.8	0x17c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:07.797939062 CEST	1.1.1.1	192.168.2.8	0x17c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:10.708720922 CEST	1.1.1.1	192.168.2.8	0x47f8	No error (0)	vanaheim.cn	213.226.112.95	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:27.801183939 CEST	1.1.1.1	192.168.2.8	0xe0fd	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:38:27.801183939 CEST	1.1.1.1	192.168.2.8	0xe0fd	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:38:27.801183939 CEST	1.1.1.1	192.168.2.8	0xe0fd	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:38:27.812226057 CEST	1.1.1.1	192.168.2.8	0xd782	No error (0)	mta6.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:27.812226057 CEST	1.1.1.1	192.168.2.8	0xd782	No error (0)	mta6.am0.yahoodns.net	67.195.228.109	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:27.812226057 CEST	1.1.1.1	192.168.2.8	0xd782	No error (0)	mta6.am0.yahoodns.net	67.195.204.72	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:27.812226057 CEST	1.1.1.1	192.168.2.8	0xd782	No error (0)	mta6.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:27.812226057 CEST	1.1.1.1	192.168.2.8	0xd782	No error (0)	mta6.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:27.812226057 CEST	1.1.1.1	192.168.2.8	0xd782	No error (0)	mta6.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:27.812226057 CEST	1.1.1.1	192.168.2.8	0xd782	No error (0)	mta6.am0.yahoodns.net	98.136.96.75	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:27.812226057 CEST	1.1.1.1	192.168.2.8	0xd782	No error (0)	mta6.am0.yahoodns.net	67.195.228.111	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:47.834175110 CEST	1.1.1.1	192.168.2.8	0x2534	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:38:47.844665051 CEST	1.1.1.1	192.168.2.8	0xc10d	No error (0)	smtp.google.com	142.251.168.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:47.844665051 CEST	1.1.1.1	192.168.2.8	0xc10d	No error (0)	smtp.google.com	66.102.1.27	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:47.844665051 CEST	1.1.1.1	192.168.2.8	0xc10d	No error (0)	smtp.google.com	142.250.110.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:47.844665051 CEST	1.1.1.1	192.168.2.8	0xc10d	No error (0)	smtp.google.com	142.250.110.27	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:38:47.844665051 CEST	1.1.1.1	192.168.2.8	0xc10d	No error (0)	smtp.google.com	142.251.168.27	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:39:07.866209984 CEST	1.1.1.1	192.168.2.8	0xbf98	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:39:07.875178099 CEST	1.1.1.1	192.168.2.8	0xaa51	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:39:07.875178099 CEST	1.1.1.1	192.168.2.8	0xaa51	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:40:06.893662930 CEST	1.1.1.1	192.168.2.8	0x8aba	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:40:06.893662930 CEST	1.1.1.1	192.168.2.8	0x8aba	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:40:06.893662930 CEST	1.1.1.1	192.168.2.8	0x8aba	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:40:06.893662930 CEST	1.1.1.1	192.168.2.8	0x8aba	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:37:58
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\SGn3RtDC8Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SGn3RtDC8Y.exe"
Imagebase:	0x400000
File size:	315'904 bytes
MD5 hash:	3CA2945C2C97310AFEF97E0C889CB8EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1443238821.0000000002BF9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.1408457761.00000000029E0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:38:01
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jlxopxf\
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:38:01
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:38:01
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ubezyssm.exe" C:\Windows\SysWOW64\jlxopxf\
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:38:01
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:38:02
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create jlxopxf binPath= "C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d\"C:\Users\user\Desktop\SGn3RtDC8Y.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xc90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:38:02
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:38:02
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description jlxopxf "wifi internet conection"
Imagebase:	0xc90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:38:02
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:38:03
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start jlxopxf
Imagebase:	0xc90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:38:03
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:38:03
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe /d"C:\Users\user\Desktop\SGn3RtDC8Y.exe"
Imagebase:	0x400000
File size:	12'340'224 bytes
MD5 hash:	32F0C83846CE2CC1E5F9549AE158AD56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.1461743704.0000000002942000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.1458167400.0000000002910000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.1461696537.0000000002910000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:38:03
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x15c0000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:38:03
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:38:03
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:38:04
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7444 -ip 7444
Imagebase:	0xb00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:38:04
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 1200
Imagebase:	0xb00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:38:05
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0xac0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	13:38:05
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7844 -ip 7844
Imagebase:	0xb00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:38:06
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7844 -s 540
Imagebase:	0xb00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:38:45
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	31.1%
Signature Coverage:	25.3%
Total number of Nodes:	1555
Total number of Limit Nodes:	18

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 0040A189
D, xrefs: 00409F8E
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A078
\, xrefs: 00409D0C
", xrefs: 00409EDB
P, xrefs: 00409DAA

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75568A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 02BFDFA0 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02BFDFC8
Module32First.KERNEL32(00000000,00000224), ref: 02BFDFE8

Memory Dump Source

Source File: 00000000.00000002.1443238821.0000000002BF9000.00000040.00000020.00020000.00000000.sdmp, Offset: 02BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf9000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 4440d5c7ba1a73f628384a68e7969eb56f83200060ae2d534756ff6ed22edbcb
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: C2F096355007126FD7603BF5988CF6EB6ECEF49668F510668E746910C0DBB0E8494A61

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75570F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75570F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75570F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75570F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,75570F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75570F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75570F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,75570F10,?,75570F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(75570F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75570F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(75570F10,?,75570F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75570F10), ref: 00407208
RegCloseKey.ADVAPI32(75570F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75570F10), ref: 004072D0
RegCloseKey.ADVAPI32(75570F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75570F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75570F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75570F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75570F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75570F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75570F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75570F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75570F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75570F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75570F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,75570F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,75570F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 029B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 029B024D

Strings

cess, xrefs: 029B018D
kernel32.dll, xrefs: 029B008F, 029B0095

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 42523d658734be5adc1b1daf10dbf1cb7dd777a4bc5754a5a5006f2d178b3ac3
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 87527974A01229DFDB65CF68C984BADBBB5BF09304F1480D9E94DAB351DB30AA85CF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75568A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 029B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,029B0223,?,?), ref: 029B0E19
SetErrorMode.KERNELBASE(00000000,?,?,029B0223,?,?), ref: 029B0E1E

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 8c5091a75a8c552e1507ec5e9f2876851e53a5403109e6d851cc54e5729abfa9
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 16D01236245228B7DB012AD4DC09BCEBB1CDF09BA6F008021FB0DE9080CBB09A4046EA

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 02BFDC5F Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02BFDCB0

Memory Dump Source

Source File: 00000000.00000002.1443238821.0000000002BF9000.00000040.00000020.00020000.00000000.sdmp, Offset: 02BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf9000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 365fcdcf214b5bd6c02bba9b13fcd45d1f0f7d9171205da20b8e0e09368dd7f4
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3D113C79A00208EFDB01DF98CA85E98BBF5EF08350F058094FA489B361D371EA54DF80

Non-executed Functions

Function 0040C913 Relevance: 115.1, APIs: 45, Strings: 20, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
`4u, xrefs: 0040CA4E, 0040CB63, 0040D56C, 0040DAD5
lid_file_upd, xrefs: 0040CE6A
flags_upd, xrefs: 0040CE4A
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
\, xrefs: 0040D39D
wtm_r, xrefs: 0040C97F
drivers\, xrefs: 0040D067
4, xrefs: 0040D9F7
wtm_c, xrefs: 0040C956
@, xrefs: 0040D754
.sys, xrefs: 0040D0CC
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
local_time, xrefs: 0040CACD
\, xrefs: 0040D3A7
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
wtm_w, xrefs: 0040C96C
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
srv_time, xrefs: 0040CABB

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$`4u$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3237684401
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtSetInformationThread, xrefs: 00401155
NtSetInformationToken, xrefs: 00401175
ntdll.dll, xrefs: 0040100D
RtlSetLastWin32Error, xrefs: 004010D6
RtlLengthSid, xrefs: 00401246
NtQueryInformationToken, xrefs: 00401262
RtlFreeSid, xrefs: 00401116
NtClose, xrefs: 004011B4
RtlNtStatusToDosError, xrefs: 00401194
NtTerminateProcess, xrefs: 004010F6
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtFilterToken, xrefs: 0040122B
NtOpenProcessToken, xrefs: 004011D4
RtlInitUnicodeString, xrefs: 00401135
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtDuplicateToken, xrefs: 004011F3

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Sep, xrefs: 0040B28E
Dec, xrefs: 0040B2A3
Mar, xrefs: 0040B264
Nov, xrefs: 0040B29C
Jun, xrefs: 0040B279
Aug, xrefs: 0040B287
May, xrefs: 0040B272
Jul, xrefs: 0040B280
Wed, xrefs: 0040B23A
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Feb, xrefs: 0040B25D
Fri, xrefs: 0040B248
Sun, xrefs: 0040B225
Oct, xrefs: 0040B295
Mon, xrefs: 0040B22C
Apr, xrefs: 0040B26B
Thu, xrefs: 0040B241
Jan, xrefs: 0040B256
Sat, xrefs: 0040B24F
Tue, xrefs: 0040B233

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00402A62 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7556F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7556F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

`4u, xrefs: 00402CC7

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: `4u
API String ID: 1639031587-6339388
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

, xrefs: 00401462
wusa.exe, xrefs: 00401388
useless, xrefs: 0040161E
<, xrefs: 00401378
@, xrefs: 00401380
uac, xrefs: 00401628
PDv, xrefs: 0040139A
D, xrefs: 004015C6
%systemroot%\system32\cmd.exe, xrefs: 00401316

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDv$uac$useless$wusa.exe
API String ID: 1628651668-868794581
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

work_srv, xrefs: 00401E5E
start_srv, xrefs: 00401E6C
lid_file_upd, xrefs: 00401E25
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
kernel32, xrefs: 00401DF7
born_date, xrefs: 00401EAD, 00401ECC
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
loader_id, xrefs: 00401F4B, 00401F6B
IsWow64Process, xrefs: 00401DF2
net_type, xrefs: 00401E87
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 029B65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 029B65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 029B6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 029B6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 029B6652

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 2e641a22c38312b16daaee350788746e9877bd09c76a33a2abd2fb289dc01123
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 36113D71600218BFDB229F75DD49FDB3FACEF457A5F104024FA08A6250D7B1ED508AA4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 029B092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 029B095F
GetProcAddress., xrefs: 029B09DC, 029B09DF, 029B09E4
l, xrefs: 029B0966

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 0a66f4f24eebff46a6d1eba4c5b0f30797ab4fddd30b559a89f81ec772f921fa
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: D33148B6900609DFDB11CF99C984AEEBBF9FF48324F14414AD841A7350D771EA45CBA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 02BFD87D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1443238821.0000000002BF9000.00000040.00000020.00020000.00000000.sdmp, Offset: 02BF9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bf9000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: b03c5603c1ef9047319c2d723c448ef2f929473f4b13b57e26d3d5c93da23a74
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 7D117072340101AFD744DF55DC80FA673EAEB89620B1980A5EA04CB315E67AE802CB60

Function 029B0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: d368135e42564d2e68dd37a759f2409f13f1ff75548028cdd3c4d342cc0a74d6
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1F01A276A106048FDF22CF24CA05BEB33E9FFC6616F4545A5D90A9B281E774A9418B90

Function 029B9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 029B9E6D
lstrcpy.KERNEL32(?,00000000), ref: 029B9FE1
lstrcat.KERNEL32(?,?), ref: 029B9FF2
lstrcat.KERNEL32(?,0041070C), ref: 029BA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 029BA054
DeleteFileA.KERNEL32(?), ref: 029BA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 029BA0D6
lstrcpy.KERNEL32 ref: 029BA12F
lstrlen.KERNEL32(00000022), ref: 029BA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 029B9F13

Part of subcall function 029B7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 029B7081

Part of subcall function 029B6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\sugxygo,029B7043), ref: 029B6F4E
Part of subcall function 029B6F30: GetProcAddress.KERNEL32(00000000), ref: 029B6F55
Part of subcall function 029B6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 029B6F7B
Part of subcall function 029B6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 029B6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 029BA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 029BA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 029BA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 029BA21B
GetDriveTypeA.KERNEL32(?), ref: 029BA265
lstrcat.KERNEL32(?,00000000), ref: 029BA29F
lstrcat.KERNEL32(?,00410A34), ref: 029BA2C5
lstrcat.KERNEL32(?,00000022), ref: 029BA2D9
lstrcat.KERNEL32(?,00410A34), ref: 029BA2F4
wsprintfA.USER32 ref: 029BA31D
lstrcat.KERNEL32(?,00000000), ref: 029BA345
lstrcat.KERNEL32(?,?), ref: 029BA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 029BA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 029BA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 029BA1D1

Part of subcall function 029B9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 029B999D
Part of subcall function 029B9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 029B99BD
Part of subcall function 029B9966: RegCloseKey.ADVAPI32(?), ref: 029B99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 029BA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 029BA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 029BA41D

Strings

D, xrefs: 029BA1F5
\, xrefs: 029B9F73
", xrefs: 029BA2DF
", xrefs: 029BA3F0
", xrefs: 029BA142
P, xrefs: 029BA011

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 9d0296501e0905c2d4e9aa8298a28ff9b280062e846319ef1dd94a5fb444024c
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 26F141B1D4025DAFDF22DBA08E48FEE7BBDAF09304F0444A6E605E2151E7759A848F64

Function 029B7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 029B7D21
GetUserNameA.ADVAPI32(?,?), ref: 029B7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029B7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 029B7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 029B7DC0
EqualSid.ADVAPI32(?,?), ref: 029B7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 029B7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029B7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 029B7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 029B7E12
LocalFree.KERNEL32(00000000), ref: 029B7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 029B7E35

Strings

D, xrefs: 029B7D73
PromptOnSecureDesktop, xrefs: 029B7FA0

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 7c7ba836c86b22620e20ab916512d3a3523af567d24313c1bda3c30b58163d96
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 06A14B72900219AFDB128FA0DE88FEEBBBDFF48744F04816AF505E6150D7758A85CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

%d=%p, xrefs: 004066F9
Jan 13 2018, xrefs: 0040653A
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
va=%08X%08X uef=%p, xrefs: 00406595
except_info, xrefs: 00406728
12:08:32, xrefs: 00406535
plgs:, xrefs: 004066AA
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

rcpt to:<%s>, xrefs: 0040A855
helo %s, xrefs: 0040A803
Incorrect respons, xrefs: 0040AB39
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
AUTH LOGIN, xrefs: 0040A80C
ehlo %s, xrefs: 0040A7F5
data, xrefs: 0040A85E
mail from:<%s>, xrefs: 0040A848
Too small respons, xrefs: 0040A9C9
Too big smtp respons (%d bytes), xrefs: 0040A9B1
., xrefs: 0040A8CA
quit, xrefs: 0040A86C
ESMTP, xrefs: 0040AA38
localcfg, xrefs: 0040AB0B

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 029B7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 029B7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029B7ACD
GetLengthSid.ADVAPI32(?), ref: 029B7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 029B7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 029B7B1F
EqualSid.ADVAPI32(?,?), ref: 029B7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 029B7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029B7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 029B7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 029B7B77
LocalFree.KERNEL32(00000000), ref: 029B7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 029B7B9A
GetAce.ADVAPI32(?,?,?), ref: 029B7BCA
EqualSid.ADVAPI32(?,?), ref: 029B7BF1
DeleteAce.ADVAPI32(?,?), ref: 029B7C0A
EqualSid.ADVAPI32(?,?), ref: 029B7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 029B7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029B7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 029B7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 029B7CE0
LocalFree.KERNEL32(00000000), ref: 029B7CEE

Strings

D, xrefs: 029B7AC3

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: f654d0ebd20af280c1c699e3fd905bd77509bb0b3fcbacd0931144b6a0a99d2b
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 20813D72900219AFDB12CFE4DE88FEEBBBCAF48305F04816AE505E6250D7759A45CF64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC
W4u, xrefs: 004019B1
123.45.67.89, xrefs: 004019A6
GetBestInterface, xrefs: 004019EF
localcfg, xrefs: 004019A3

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$W4u
API String ID: 835516345-1619806614
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 029B858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 029B865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 029B867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 029B86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 029B86B1

Strings

PromptOnSecureDesktop, xrefs: 029B85B6, 029B8645, 029B86BD, 029B8708, 029B87C5, 029B8812, 029B88E9, 029B8905
", xrefs: 029B896C

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 128f38fcc887b322a511e1dd8b67b7c755268c2cc85ed0bd091818acd99c2f06
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 88C17F71900149BFEF12ABA4DE89EEE7BBDEF48304F144066F604A6050E7714A948B65

Function 029B2CC9 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 029B2CED
socket.WS2_32(00000002,00000002,00000011), ref: 029B2D07
htons.WS2_32(00000000), ref: 029B2D42
select.WS2_32 ref: 029B2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 029B2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 029B2E62

Strings

`4u, xrefs: 029B2F2E

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: `4u
API String ID: 127016686-6339388
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: a844754e445bd0e1a5e81102e49a2f9bdfbb3dfbc358388cf5ba20d742e5a797
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 9A61EF71904305ABC322AF65DD08BEBBBECEF88745F004829FD8497160D7B4D880CBA6

Function 029B14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 029B1601
lstrlenW.KERNEL32(-00000003), ref: 029B17D8

Strings

D, xrefs: 029B182D
<, xrefs: 029B15DF
@, xrefs: 029B15E7
, xrefs: 029B16C9

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: df3caf3a0597b9f19cd2fbfeb3b8e886828a1896a4627902182df770bcccf36e
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: D4F1ACB11083819FD721CF64C998BEBB7E9FF88304F10892DF59A972A0D7B49944CB56

Function 029B7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 029B76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 029B7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 029B778F
___ascii_stricmp.LIBCMT ref: 029B78B4
RegCloseKey.ADVAPI32(?), ref: 029B794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 029B796D
RegCloseKey.ADVAPI32(?), ref: 029B797E
RegCloseKey.ADVAPI32(?), ref: 029B79AC
RegCloseKey.ADVAPI32(?), ref: 029B7A56

Part of subcall function 029BF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,029B772A,?), ref: 029BF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 029B79F6
RegCloseKey.ADVAPI32(?), ref: 029B7A4D

Strings

PromptOnSecureDesktop, xrefs: 029B76C5, 029B76CA, 029B76E5, 029B7782, 029B77E6, 029B7862, 029B787B, 029B79C2
", xrefs: 029B7800

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 6f5b54e8bedef0f98781eeb8a28d7cd6d8db4efced1db3dc229972a8566402c9
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 52C17372900209AFDB12DBE4DE44FEEBBBDEF89710F1441A5E544E6190EB71DA84CB60

Function 00402DF2 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,755723A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
W4u, xrefs: 00402E93
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$W4u
API String ID: 929413710-1050870963
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%s%d, xrefs: 0040AE58
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
127.0.0.1, xrefs: 0040ADEB

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 029B958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 029B95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 029B95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 029B95DC
wsprintfA.USER32 ref: 029B9635
wsprintfA.USER32 ref: 029B9673
wsprintfA.USER32 ref: 029B96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 029B9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 029B978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 029B97D8

Strings

PromptOnSecureDesktop, xrefs: 029B9604, 029B9624, 029B9662, 029B9683, 029B96B6, 029B96DF, 029B9701, 029B9734, 029B9780, 029B97B7

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: b001f930b03aa73000ae96becf5d14f5538d158dcdeb970be76d510faaee7d44
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 16A16AB295020CAFEB22DFA0CD85FDA3BADEF48740F104026FA15A6151E7B5D584CFA4

Function 0040F315 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

`4u, xrefs: 0040F375, 0040F3A0
time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: `4u$time_cfg
API String ID: 311057483-456741473
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

86A, xrefs: 0040BF98
06A, xrefs: 0040BF70
46A, xrefs: 0040BF85
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_USER, xrefs: 0040B488
%P5DATE, xrefs: 0040B4F2
%TO_DOMAIN, xrefs: 0040B44B
%TO_HASH, xrefs: 0040B4B0
%TO_EMAIL, xrefs: 0040B473
%DATE, xrefs: 0040B4D2
%FROM_DOMAIN, xrefs: 0040B41E
%M5DATE, xrefs: 0040B50F
%s@%s, xrefs: 0040B461
%FROM_EMAIL, xrefs: 0040B3E9
%FROM_USER, xrefs: 0040B431

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 029B1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 029B202D
GetSystemInfo.KERNEL32(?), ref: 029B204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 029B206A
GetProcAddress.KERNEL32(00000000), ref: 029B2071
GetCurrentProcess.KERNEL32(?), ref: 029B2082
GetTickCount.KERNEL32 ref: 029B2230

Part of subcall function 029B1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 029B1E7C

Strings

hi_id, xrefs: 029B217D, 029B2182, 029B219A
work_srv, xrefs: 029B20C5
localcfg, xrefs: 029B2091, 029B2098, 029B20AB, 029B20E4, 029B20F3, 029B2119, 029B2138, 029B214E, 029B2166, 029B2183, 029B219B, 029B21B7, 029B21D7
flags_upd, xrefs: 029B20A5, 029B20AA, 029B20E3

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: ad89a558a526af43ddb215cb195e7ef56d43268a244c1e1827628b41dc779185
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 1E5137B0900348AFE332AF758D84FE7BAECEF85704F40491DF99692142D7B8A544CB65

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7568EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7568EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 029B3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 029B3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 029B3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 029B3095
RtlAllocateHeap.NTDLL(00000000), ref: 029B30B6
htons.WS2_32(00000035), ref: 029B30EF
inet_addr.WS2_32(?), ref: 029B30FA
gethostbyname.WS2_32(?), ref: 029B310D
HeapFree.KERNEL32(00000000), ref: 029B314D

Strings

iphlpapi.dll, xrefs: 029B3062, 029B3067, 029B3077

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: a34baf1f08ff3a42c0dd7040d1b1c7549d64c0ca321ca18b9277bb9fac303ece
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: BF31B631A00206BBDB12DBB89D48BEE77BCEF05764F1441A5E918E7290DB74D541CB5C

Function 029BF57C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(029BCC84), ref: 029BF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 029BF5CE
closesocket.WS2_32(00000000), ref: 029BF5DC

Strings

time_cfg, xrefs: 029BF58A
`4u, xrefs: 029BF5DC, 029BF607

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: `4u$time_cfg
API String ID: 311057483-456741473
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: c36697e206fae3cdf7e980bad387d8d87737c7ecd7eaa711cf87e197ec3a304b
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 10318C7290011CABDB12DFB5DD88DEEBBBCEF88314F104566F905E3150E7708A818BA4

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,755723A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 029B6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 029B67C3
htonl.WS2_32(?), ref: 029B67DF
htonl.WS2_32(?), ref: 029B67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 029B68F1
ExitProcess.KERNEL32 ref: 029B69BC

Strings

except_info, xrefs: 029B698F
localcfg, xrefs: 029B6994

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 252678702cf82b402801c59cd2f9c6b4ca81ac2595015a62932f1b0a42368217
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: B3616E71940208AFDF619FA4DC45FEA77E9FF48300F148066FA6DD2161DB75A9908F14

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 029B2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 029B2FA1
LoadLibraryA.KERNEL32(?), ref: 029B2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 029B2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 029B3000
RtlAllocateHeap.NTDLL(00000000), ref: 029B3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 029B3032

Strings

dnsapi.dll, xrefs: 029B2F90

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 70892c50e9f0fef74d2f2dd83acb9e5615e6e99a6c72556d0a2db01196819b8f
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 8F21A171D01229BBCB22DF54DD88AEEBBBCEF08B50F004461F901E7540D7B49A8187E4

Function 029B6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\sugxygo,029B7043), ref: 029B6F4E
GetProcAddress.KERNEL32(00000000), ref: 029B6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 029B6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 029B6F92

Strings

C:\Windows\SysWOW64\, xrefs: 029B6F30, 029B6F38, 029B6F65, 029B6F6C, 029B6F7A, 029B6F85, 029B6F91, 029B6FA9, 029B6FC6, 029B6FEC
\\.\pipe\sugxygo, xrefs: 029B6F37
PromptOnSecureDesktop, xrefs: 029B6F9D, 029B6FBF, 029B6FCF, 029B6FE5, 029B6FF5

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\sugxygo
API String ID: 1082366364-1010374325
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 5b80198d06729259e56e476fa3693be4d4e72ab31c98098d4ae44dd958e85e30
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 8D2102227413447AF72353359E8CFFB3E4D8F92B24F1880A6F944E6490DBD994D682AD

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 029B92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 029B92E2
wsprintfA.USER32 ref: 029B9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 029B9375
lstrlen.KERNEL32(?,?,00000000), ref: 029B9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 029B9394
CloseHandle.KERNEL32(00000000), ref: 029B939B

Strings

PromptOnSecureDesktop, xrefs: 029B932B, 029B9343, 029B935E

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: d971f06e0db10fb17e1b9cf8529f5022460c67be7a2fcb7cdf31ea2048674fb6
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: E81172B16401147BE7216B31ED0DFEF3A6EDFC9B10F008065BB09A5091EAB54E418A64

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 029B99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 029B9A18
GetThreadContext.KERNEL32(?,?), ref: 029B9A52
TerminateProcess.KERNEL32(?,00000000), ref: 029B9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 029B9A98
SetThreadContext.KERNEL32(?,00010002), ref: 029B9AB5
ResumeThread.KERNEL32(?), ref: 029B9AC2

Strings

D, xrefs: 029B9A10

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 449f0eba3b288d6ad1fe802a7e411e42e269c3f35a46c60dd6b4c4e49e3e0bf3
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 1B213BB1A01219BBEB129BA1DD09EEFBBBCEF05750F404061BA19E5050E7759A84CFA4

Function 029B1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 029B1C18
LoadLibraryA.KERNEL32(004102C8), ref: 029B1C26
GetProcessHeap.KERNEL32 ref: 029B1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 029B1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 029B1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 029B1D02
FreeLibrary.KERNEL32(?), ref: 029B1D0B

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 93ec63b452a1e726b86677f70ec18d0d73d7beef71ff0b516573d3844ca42d18
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: C7315E31E00209BFCB129FE4DE988EEBBB9EF85705F24447AE509E2110D7B54E80DB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 029B6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 029B6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 029B6D22
GetLastError.KERNEL32 ref: 029B6DA7
CloseHandle.KERNEL32(?), ref: 029B6DB5
GetLastError.KERNEL32 ref: 029B6DD6
DeleteFileA.KERNEL32(?), ref: 029B6DE7
GetLastError.KERNEL32 ref: 029B6DFD

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 8b323eb0eddfb865d11c9424e8aac627905ba7559ee8614626d6975b43b5d16d
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 5131E176900249BFCB02DFA4DE48ADE7F7DEF88310F148476E251E3250D770AA958B65

Function 029B93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 029B93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 029B93CD
CharToOemA.USER32(?,?), ref: 029B93DB
wsprintfA.USER32 ref: 029B9410

Part of subcall function 029B92CB: GetTempPathA.KERNEL32(00000400,?), ref: 029B92E2
Part of subcall function 029B92CB: wsprintfA.USER32 ref: 029B9350
Part of subcall function 029B92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 029B9375
Part of subcall function 029B92CB: lstrlen.KERNEL32(?,?,00000000), ref: 029B9389
Part of subcall function 029B92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 029B9394
Part of subcall function 029B92CB: CloseHandle.KERNEL32(00000000), ref: 029B939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 029B9448

Strings

PromptOnSecureDesktop, xrefs: 029B93FA, 029B93FF, 029B941C

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: c6c1ec20cdbecd40651e6a05e1a5bec1c252ce1a6c8c2fe8c6c113f18cfb704d
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 33015EF69001187BEB21A7619E8DEDF3B7CDB95701F0040A2BB49E2080EAB497C58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 029BAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 029BAAE5

Strings

, xrefs: 029BABB3
localcfg, xrefs: 029BAD72

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: cfd63c9f51d115d1a3a7bdd0ca8150eef1c3339cb8dc1f674b8cd26bf15dc2df
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: FF713B71A00318BADF338B58DE85FEE376DAF81709F244467F904A6090DF7295C48B59

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 029BE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 029BDF6C: GetCurrentThreadId.KERNEL32 ref: 029BDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 029BE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,029B6128), ref: 029BE950
lstrcmp.KERNEL32(?,00000008), ref: 029BE989

Strings

A, xrefs: 029BE960, 029BE965
A, xrefs: 029BE8C6, 029BE8CD, 029BE936, 029BE998
A, xrefs: 029BE9A0

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: de33c884d5404985c5aea482ab15409ab6ba6d6156173993e0edb9d6f5071644
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 5831B231A007059BDF738F24C9847E67BECEF09715F80892AE5D687551D374E888CB91

Function 029B6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 029B6E19

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 269d167a4fa46e2f1865d4837adcbfaaa042f403356f295e4d73e0c557cbf7ac
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 37212E7A104119BFDB129BB0FE48EDF7FADEF49665B108425F502D1090EB70EA509B74

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75570F10,?,00000000,0040E538,?,75570F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 029BC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 029BC6B4
InterlockedIncrement.KERNEL32(029BC74B), ref: 029BC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,029BC747), ref: 029BC728
CloseHandle.KERNEL32(00000000,?,029BC747,00413588,029B8A77), ref: 029BC733

Strings

localcfg, xrefs: 029BC544

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: bec825192b39cae195558dc7e12f6a7e09e74ab2b81729216591cbf9874febf6
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: FE514AB1A01B468FD7258F69C6D466ABBE9FF88304B50593FE18BC7A90D774E840CB10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75570F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75570F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75570F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75570F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75570F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75570F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75570F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 029BE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,029BE50A,00000000,00000000,00000000,00020106,00000000,029BE50A,00000000,000000E4), ref: 029BE319
RegSetValueExA.ADVAPI32(029BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029BE38E
RegDeleteValueA.ADVAPI32(029BE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029BE3BF
RegCloseKey.ADVAPI32(029BE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,029BE50A), ref: 029BE3C8

Strings

PromptOnSecureDesktop, xrefs: 029BE33A

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 9d76c320faad90ea19956aa9fab8038ea3668973ae80c17f05a3b634b1221a7c
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: E3214A71A0021DBBDF229FA4ED89EEE7F7DEF08750F008021F944A6160E3718A54DBA0

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 029B71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 029B71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029B7228
LocalFree.KERNEL32(?,?,?), ref: 029B7286
wsprintfA.USER32 ref: 029B729D

Strings

|, xrefs: 029B721A

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 464caa247c195e7534b5bb02cc54ca1f80958e5cce00a0371cebc8f276fa4088
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 9F312972A00208BFDB02DFA8DD45BDA7BACEF44314F14C166F959DB240EB75D6488BA4

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 029BB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 029BB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 029BB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 029BB548
GetTimeZoneInformation.KERNEL32(?), ref: 029BB590
wsprintfA.USER32 ref: 029BB61E

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 724ddb351160e7a98ca85c30cafe30d6e01b5a0d55529ddfa370c3705feaab14
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 5C511EB1D0021CAACF15DFD5D9889EEBBB9BF48304F10856AE505A6150E7F84AC9CF98

Function 029B62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 029B6303
LoadLibraryA.KERNEL32(?), ref: 029B632A
GetProcAddress.KERNEL32(00000000,?), ref: 029B63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 029B6405

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: aad41257da8cabcb71046fe7f354872aea0c2073ae96a8a25e94b59b3bd7ad9d
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 3B417971A00609ABDB16CF58CA84BEDBBBDFF04318F188469E969D7290E731F940CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75570F18,00000000,?,75570F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75570F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75570F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 029BE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 029BDF6C: GetCurrentThreadId.KERNEL32 ref: 029BDFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,029BA6AC), ref: 029BE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,029BA6AC), ref: 029BE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,029BA6AC), ref: 029BE819

Strings

PromptOnSecureDesktop, xrefs: 029BE840, 029BE845, 029BE87C, 029BE89B

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: d6e9b282dc8568db452486c088d9ea86cdff918c519168309b7c6df57c138980
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: D32127B1A003047AF6237735AE49FEB3E0DDFA5B60F500034FA49B55D3EAA594508AB9

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,75570F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,75570F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,75570F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 029B7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 029B76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 029B796D
RegCloseKey.ADVAPI32(?), ref: 029B797E

Strings

PromptOnSecureDesktop, xrefs: 029B76C5, 029B76CA, 029B76E5

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: ef94afd45ec1076651251536969ba03c45657d08baa4c1dd71f67a8475297232
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: E811DC32A00109AFDB128FA9DD44FEFBF7DEF86704F140261F510E6290E3B089408B61

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 029B9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 029B999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 029B99BD
RegCloseKey.ADVAPI32(?), ref: 029B99C6

Strings

PromptOnSecureDesktop, xrefs: 029B9989, 029B998E, 029B99B0, 029B99D3

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: e7075a9d172f9563088b878039ea5a8e8b19e09ea91dffb2c3ee4635050989d4
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 3DF0F6B2A80208BBF7116B54ED46FDB3A2CDF95B10F104060FA05B5091F6E59A9086BD

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 029B28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 029B28FA
gethostbyname.WS2_32(u6A), ref: 029B2906

Strings

u6A, xrefs: 029B28EC, 029B28F9, 029B2905
time_cfg, xrefs: 029B28EB

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: e12e3185b9d493d41d2444881e38ff6fe0016d23374082560665e496e5f71b62
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: DCE0C230A041119FCB018B2CF948AC537E8EF0A230F008580F844C31A0C734DCC09780

Function 00402684 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684
W4u, xrefs: 00402693

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$W4u
API String ID: 1594361348-4149107023
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 029BD7D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 029BD7D3
Sleep.KERNEL32(000003E8), ref: 029BD7DE
ExitProcess.KERNEL32 ref: 029BD7EA

Strings

`4u, xrefs: 029BD7D3

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: `4u
API String ID: 2012141568-6339388
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: 3aef7f9a6dea1a1d2c3181746ccb3f84fcea5ab5969f81252adab277ea808dad
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: F4C04830801208EBCB422BB4FC4CACC3E6AAF48302B20C160A14A910B0CAB00A909A29

Function 029B69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 029B69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 029B6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 029B6A3A
CloseHandle.KERNEL32(000000FF), ref: 029B6BD8

Part of subcall function 029BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,029B1DCF,?), ref: 029BEEA8
Part of subcall function 029BEE95: HeapFree.KERNEL32(00000000), ref: 029BEEAF

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 37a56a69097bbaca44971f93b24aa9fc4b056b55e35b644095545d563b4f8c0d
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 1C71057190422DEFDF129FA4CD80AEEBBBDFF08354F10456AE515A6190D730AE92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 029B41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 029B421F
GetLastError.KERNEL32 ref: 029B4229
WaitForSingleObject.KERNEL32(?,?), ref: 029B423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 029B424D

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 1583882053477f464152fbe648e7064e94fafd86c941f07aa2be2d7e6cc1a3b1
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: E801A572911109ABDF02DF90EE84BEE7BACEF08255F108461F901E6051D7709A54ABB6

Function 029B417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 029B41AB
GetLastError.KERNEL32 ref: 029B41B5
WaitForSingleObject.KERNEL32(?,?), ref: 029B41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 029B41D9

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 0bf8d5b814dfd0e2f984cb7a65127b0e70dc19d50f841843927de349a85ea806
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: A6010C7691110AAFDF02DF90EE84BEF7B6CEF18255F004061F905E2051D770DA549BB5

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 029BE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 029BE066

Strings

A, xrefs: 029BE07F
A, xrefs: 029BE036
A, xrefs: 029BE037, 029BE03C

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 4c529f75edd2e8cfe3e5ce6fd2df7b88aaa4afb1ac67e450f00f64224b4967f4
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 5EF062312047069BCB22CF25D984AD2B7FDFF05325B84862AE595C3060D374A498CB55

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 029BE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,029B44E2,00000000,00000000,00000000), ref: 029BE470
CloseHandle.KERNEL32(00000001,00000003), ref: 029BE484

Part of subcall function 029BE2FC: RegCreateKeyExA.ADVAPI32(80000001,029BE50A,00000000,00000000,00000000,00020106,00000000,029BE50A,00000000,000000E4), ref: 029BE319
Part of subcall function 029BE2FC: RegSetValueExA.ADVAPI32(029BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029BE38E
Part of subcall function 029BE2FC: RegDeleteValueA.ADVAPI32(029BE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029BE3BF
Part of subcall function 029BE2FC: RegCloseKey.ADVAPI32(029BE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,029BE50A), ref: 029BE3C8

Strings

PromptOnSecureDesktop, xrefs: 029BE4F1, 029BE4F6, 029BE537, 029BE561

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: bcb20d6c6b0d9502d3813669cb1dd65ff94b44909dfcd9bdd8c423c61b675e4f
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 6B413AB2D00208BBEF226F518E45FEB3F6DEF45764F408125FE0894091E7B59650CAB4

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 029B8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 029B83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 029B8477

Part of subcall function 029B69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 029B69E5
Part of subcall function 029B69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 029B6A26
Part of subcall function 029B69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 029B6A3A

Part of subcall function 029BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,029B1DCF,?), ref: 029BEEA8
Part of subcall function 029BEE95: HeapFree.KERNEL32(00000000), ref: 029BEEAF

Strings

PromptOnSecureDesktop, xrefs: 029B83B2, 029B83B7, 029B8483

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 058d2e2d666173b218db3641edf9ac7209f9ca70d6ccf167a095350667d46fca
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 21417FB2901109BFEB12EBA09F84EFF776EFF48344F0444A6E508D6050E7B05A948B64

Function 029BE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,029BE859,00000000,00020119,029BE859,PromptOnSecureDesktop), ref: 029BE64D
RegCloseKey.ADVAPI32(029BE859,?,?,?,?,000000C8,000000E4), ref: 029BE787

Strings

PromptOnSecureDesktop, xrefs: 029BE637

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 3c2d0fbef72c9dfe7e0e6f34c9e6c9280ce7bc3d8b16ed3aa8b90b5dc213d095
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 6C4117B2D0011DBFDF12AFA4DD85EEEBB7EFF04304F504466EA00A6160E3719A559B60

Function 029BAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 029BAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 029BB00D

Part of subcall function 029BAF6F: gethostname.WS2_32(?,00000080), ref: 029BAF83
Part of subcall function 029BAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 029BAFE6

Part of subcall function 029B331C: gethostname.WS2_32(?,00000080), ref: 029B333F
Part of subcall function 029B331C: gethostbyname.WS2_32(?), ref: 029B3349

Part of subcall function 029BAA0A: inet_ntoa.WS2_32(00000000), ref: 029BAA10

Strings

%OUTLOOK_BND_, xrefs: 029BB076, 029BB07B, 029BB0BE, 029BB0DD

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: be7d2e97a8a8cedca03450c7ab4067071aee5f4092de5c340df3a6be6ba360d5
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: C041317290020CABDB26EFA0DD45EEE3BADFF48304F144426F92992151EA75D654CF54

Function 029B9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 029B9536
Sleep.KERNEL32(000001F4), ref: 029B955D

Strings

, xrefs: 029B94D9

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 1cef30d1c57343924a909a52278edcb6d428be0b9a691c09745483575441051d
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 3F4125718583986EFB378B64DA8C7E63BAD9F02314F1400A5DA86871A2D7F44980CF11

Function 029BBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 029BB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 029BBA3A
InterlockedIncrement.KERNEL32(?), ref: 029BBA94
GetTickCount.KERNEL32 ref: 029BBB79
GetTickCount.KERNEL32 ref: 029BBB99
InterlockedIncrement.KERNEL32(?), ref: 029BBE15
closesocket.WS2_32(00000000), ref: 029BBEB4

Strings

%FROM_EMAIL, xrefs: 029BBC7D

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 2d9468a872f1de813176799bfbeafec710fd1fcee8303e8f3e7621881576d352
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 07317C71500248DFDF26DFA4DE98BEDB7A9EF88704F20446AFA24821A0DB34D685CF50

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 029B709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 029B70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 029B70F4

Strings

|, xrefs: 029B70E6

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 9175a348efa739e0004460cb552a100cf30286f3c4aaeb23d62e2edb7989c23b
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: E411FA73900118EBDB12CBD4DD84AEEB7BDAF44719F1442A6E501E6194D7709B88CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7568EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 029B3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 029B2F88: GetModuleHandleA.KERNEL32(?), ref: 029B2FA1
Part of subcall function 029B2F88: LoadLibraryA.KERNEL32(?), ref: 029B2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 029B31DA
HeapFree.KERNEL32(00000000), ref: 029B31E1

Memory Dump Source

Source File: 00000000.00000002.1442705056.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29b0000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 458f2a3c6801884b0a0f90d64a1ec5e32411f1e96aa837dc75be210740d6b19e
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: B7518A7190024AEFCB02DF64DD88AFAB779FF05304B1445A9EC9687220E7329A19CB94

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,755723A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.1441463942.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1441463942.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SGn3RtDC8Y.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: ubezyssm.exePID: 7844, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	30.6%
Signature Coverage:	0%
Total number of Nodes:	1568
Total number of Limit Nodes:	14

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\SGn3RtDC8Y.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 0040A1D9
jlxopxf, xrefs: 0040A389, 0040A397
", xrefs: 0040A078
", xrefs: 0040A189
\, xrefs: 00409D0C
D, xrefs: 00409F8E
P, xrefs: 00409DAA
%X%08X, xrefs: 0040A0B0
C:\Users\user\Desktop\SGn3RtDC8Y.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
", xrefs: 00409EDB

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\SGn3RtDC8Y.exe$C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe$D$P$\$jlxopxf
API String ID: 2089075347-2332278139
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75570F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75570F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75570F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75570F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75570F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75570F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75570F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 028F003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 028F024D

Strings

kernel32.dll, xrefs: 028F008F, 028F0095
cess, xrefs: 028F018D

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 69f71b938f3a6d9eeffa4f2f6de03bae6fbad3792799538104a82ea99e8ee75e
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 20526D78A01229DFDBA4CF58C984BACBBB1BF09304F1480D9E54DA7356DB30AA95CF15

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 02947188 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 029471B0
Module32First.KERNEL32(00000000,00000224), ref: 029471D0

Memory Dump Source

Source File: 0000000C.00000002.1461743704.0000000002942000.00000040.00000020.00020000.00000000.sdmp, Offset: 02942000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2942000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9051d2012629686916d5b6917adcc5b1ecd48e65d31cfb91bdc89b51b8669267
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 84F090322007196FE7203BF9ACCCFAFB6EDAF8D625F100628E646914C0DF70E8454A61

Function 028F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,028F0223,?,?), ref: 028F0E19
SetErrorMode.KERNELBASE(00000000,?,?,028F0223,?,?), ref: 028F0E1E

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f9c93ad7a8c7aa5f7df069495d7554a66e6d268b830cae725a4b375d2c60ecd3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 2ED01235545128B7D7402A94DC09BCD7B1CDF05B66F008011FB0DD9081C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 02946E47 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02946E98

Memory Dump Source

Source File: 0000000C.00000002.1461743704.0000000002942000.00000040.00000020.00020000.00000000.sdmp, Offset: 02942000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2942000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 61fc4d192b974c49e13e68d934ec68da92e4b0af6152e5be98b64c43be007374
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 43113979A00208EFDB01DF98C985E99BFF5AF48350F0580A4FA489B361D771EA90DF80

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 028F65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 028F65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 028F6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 028F6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 028F6652

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: f40ccf4471f8913a95bfcca5ad6437c13ea84249bcc3d175c15071a9bd8392f3
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 8E11A779600228BFDB519F65DC05F9B3FACEB047A5F004124FB18E7251E7B1DD008AA4

Function 028F9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 028F9E6D
lstrcpy.KERNEL32(?,00000000), ref: 028F9FE1
lstrcat.KERNEL32(?,?), ref: 028F9FF2
lstrcat.KERNEL32(?,0041070C), ref: 028FA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 028FA054
DeleteFileA.KERNEL32(?), ref: 028FA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 028FA0D6
lstrcpy.KERNEL32 ref: 028FA12F
lstrlen.KERNEL32(00000022), ref: 028FA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 028F9F13

Part of subcall function 028F7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 028F7081

Part of subcall function 028F6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\sugxygo,028F7043), ref: 028F6F4E
Part of subcall function 028F6F30: GetProcAddress.KERNEL32(00000000), ref: 028F6F55
Part of subcall function 028F6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 028F6F7B
Part of subcall function 028F6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 028F6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 028FA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 028FA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 028FA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 028FA21B
GetDriveTypeA.KERNEL32(?), ref: 028FA265
lstrcat.KERNEL32(?,00000000), ref: 028FA29F
lstrcat.KERNEL32(?,00410A34), ref: 028FA2C5
lstrcat.KERNEL32(?,00000022), ref: 028FA2D9
lstrcat.KERNEL32(?,00410A34), ref: 028FA2F4
wsprintfA.USER32 ref: 028FA31D
lstrcat.KERNEL32(?,00000000), ref: 028FA345
lstrcat.KERNEL32(?,?), ref: 028FA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 028FA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 028FA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 028FA1D1

Part of subcall function 028F9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 028F999D
Part of subcall function 028F9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 028F99BD
Part of subcall function 028F9966: RegCloseKey.ADVAPI32(?), ref: 028F99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 028FA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 028FA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 028FA41D

Strings

\, xrefs: 028F9F73
", xrefs: 028FA2DF
P, xrefs: 028FA011
", xrefs: 028FA3F0
", xrefs: 028FA142
D, xrefs: 028FA1F5

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 6e244ad612768661b333f83193bb8efd52f8fd05b3fb024f36c6a8cf7b726d28
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 62F150B9D40219AFDF65DBA4DC48FEF7BBCAB08304F0480A6E709E2141E77596848F65

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlNtStatusToDosError, xrefs: 00401194
NtFilterToken, xrefs: 0040122B
NtSetInformationThread, xrefs: 00401155
RtlLengthSid, xrefs: 00401246
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtSetInformationToken, xrefs: 00401175
NtClose, xrefs: 004011B4
NtQueryInformationToken, xrefs: 00401262
NtDuplicateToken, xrefs: 004011F3
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlSetLastWin32Error, xrefs: 004010D6
ntdll.dll, xrefs: 0040100D
RtlFreeSid, xrefs: 00401116
NtTerminateProcess, xrefs: 004010F6
NtOpenProcessToken, xrefs: 004011D4
RtlInitUnicodeString, xrefs: 00401135

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Feb, xrefs: 0040B25D
Jul, xrefs: 0040B280
Jun, xrefs: 0040B279
Fri, xrefs: 0040B248
Wed, xrefs: 0040B23A
Dec, xrefs: 0040B2A3
Thu, xrefs: 0040B241
Tue, xrefs: 0040B233
Oct, xrefs: 0040B295
Sun, xrefs: 0040B225
May, xrefs: 0040B272
Mon, xrefs: 0040B22C
Mar, xrefs: 0040B264
Jan, xrefs: 0040B256
Sep, xrefs: 0040B28E
Aug, xrefs: 0040B287
Apr, xrefs: 0040B26B
Nov, xrefs: 0040B29C
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Sat, xrefs: 0040B24F

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 028F7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 028F7D21
GetUserNameA.ADVAPI32(?,?), ref: 028F7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 028F7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 028F7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 028F7DC0
EqualSid.ADVAPI32(?,?), ref: 028F7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 028F7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 028F7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 028F7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 028F7E12
LocalFree.KERNEL32(00000000), ref: 028F7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 028F7E35

Strings

C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 028F7F49, 028F7F76, 028F7F8A, 028F7F8B
D, xrefs: 028F7D73

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe$D
API String ID: 2976863881-1525390353
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 3ac7913e89886c20ca028ca03cf6e682bea571d8f5e4be03d07d377a6f6eef4f
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: FCA16179900219AFEF51CFA4DC44FEEBBB9FB48704F04816AF605E6150D7758A84CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24
D, xrefs: 00407B0C

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe$D
API String ID: 2976863881-1525390353
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

%d=%p, xrefs: 004066F9
12:08:32, xrefs: 00406535
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
plgs:, xrefs: 004066AA
va=%08X%08X uef=%p, xrefs: 00406595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
except_info, xrefs: 00406728
localcfg, xrefs: 0040672D
Jan 13 2018, xrefs: 0040653A
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

., xrefs: 0040A8CA
quit, xrefs: 0040A86C
AUTH LOGIN, xrefs: 0040A80C
rcpt to:<%s>, xrefs: 0040A855
data, xrefs: 0040A85E
Incorrect respons, xrefs: 0040AB39
mail from:<%s>, xrefs: 0040A848
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ESMTP, xrefs: 0040AA38
helo %s, xrefs: 0040A803
localcfg, xrefs: 0040AB0B
ehlo %s, xrefs: 0040A7F5
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
Too small respons, xrefs: 0040A9C9

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 028F7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 028F7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 028F7ACD
GetLengthSid.ADVAPI32(?), ref: 028F7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 028F7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 028F7B1F
EqualSid.ADVAPI32(?,?), ref: 028F7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 028F7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 028F7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 028F7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 028F7B77
LocalFree.KERNEL32(00000000), ref: 028F7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 028F7B9A
GetAce.ADVAPI32(?,?,?), ref: 028F7BCA
EqualSid.ADVAPI32(?,?), ref: 028F7BF1
DeleteAce.ADVAPI32(?,?), ref: 028F7C0A
EqualSid.ADVAPI32(?,?), ref: 028F7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 028F7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 028F7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 028F7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 028F7CE0
LocalFree.KERNEL32(00000000), ref: 028F7CEE

Strings

D, xrefs: 028F7AC3

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 609a89b13ae7ed6533eff87bf674ce29eba371b48ad38762fb4b53e9453f4476
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: E1814D79900219AFFB51CFA4DD84FEEBBB8AF08304F14816AE609E6150D7759641CB64

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 004085C8, 004085D5, 004085E5
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe$localcfg
API String ID: 237177642-1805313226
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00402A62 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7556F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7556F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

`4u, xrefs: 00402CC7

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: `4u
API String ID: 1639031587-6339388
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

D, xrefs: 004015C6
%systemroot%\system32\cmd.exe, xrefs: 00401316
<, xrefs: 00401378
useless, xrefs: 0040161E
wusa.exe, xrefs: 00401388
@, xrefs: 00401380
PDv, xrefs: 0040139A
uac, xrefs: 00401628
, xrefs: 00401462

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDv$uac$useless$wusa.exe
API String ID: 1628651668-868794581
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 0040199C Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
GetIfEntry, xrefs: 004019E4
Iphlpapi.dll, xrefs: 004019B7
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC
W4u, xrefs: 004019B1

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$W4u
API String ID: 835516345-1619806614
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

start_srv, xrefs: 00401E6C
kernel32, xrefs: 00401DF7
work_srv, xrefs: 00401E5E
lid_file_upd, xrefs: 00401E25
loader_id, xrefs: 00401F4B, 00401F6B
IsWow64Process, xrefs: 00401DF2
net_type, xrefs: 00401E87
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
born_date, xrefs: 00401EAD, 00401ECC

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 028F858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 028F865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 028F867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 028F86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 028F86B1

Strings

", xrefs: 028F896C
C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 028F882F, 028F883C, 028F884C

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe
API String ID: 237177642-960168564
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 50ad59b2954be3e42300e8dc8ea82db7abd91cfffea6aa6ec4d6a3bb0934bfde
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 0AC1A17E900249BEEB51ABA4DD84EEF7BBDEB08304F144066F704E6050E7704A948F65

Function 028F2CC9 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 028F2CED
socket.WS2_32(00000002,00000002,00000011), ref: 028F2D07
htons.WS2_32(00000000), ref: 028F2D42
select.WS2_32 ref: 028F2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 028F2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 028F2E62

Strings

`4u, xrefs: 028F2F2E

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: `4u
API String ID: 127016686-6339388
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 4bb18e8a8334c21515cde5e16255334120e9d7757af38038e3a7405a63141326
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 3E61F37D504309ABC360AF64DC08B6BBBE8EB48755F114819FE88D7155E7B4D880CBA6

Function 028F14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 028F1601
lstrlenW.KERNEL32(-00000003), ref: 028F17D8

Strings

@, xrefs: 028F15E7
D, xrefs: 028F182D
, xrefs: 028F16C9
<, xrefs: 028F15DF

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: c0ba871c71d8b957537cf1c339359c2abe325f3f883af1bd4c9b03f7b40fa733
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 94F17EB9608341DFD720CF64C888BABB7E5FB88305F40892DFA99D7290D7749944CB66

Function 00402DF2 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,755723A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28
W4u, xrefs: 00402E93

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$W4u
API String ID: 929413710-1050870963
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 028F7666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 028F76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 028F7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 028F778F
___ascii_stricmp.LIBCMT ref: 028F78B4
RegCloseKey.ADVAPI32(?), ref: 028F794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 028F796D
RegCloseKey.ADVAPI32(?), ref: 028F797E
RegCloseKey.ADVAPI32(?), ref: 028F79AC
RegCloseKey.ADVAPI32(?), ref: 028F7A56

Part of subcall function 028FF40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,028F772A,?), ref: 028FF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 028F79F6
RegCloseKey.ADVAPI32(?), ref: 028F7A4D

Strings

", xrefs: 028F7800

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 9136a90525a85471ee27d9cc49cade45a1a223bd8ebdbc03332e067ff373a2cf
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 43C1947D900209AFEB51DFA8DC44FEEBBB9EF49310F1040A5E704E6190EB759A94CB61

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75570F10,?,75570F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(75570F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75570F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(75570F10,?,75570F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75570F10), ref: 00407208
RegCloseKey.ADVAPI32(75570F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75570F10), ref: 004072D0
RegCloseKey.ADVAPI32(75570F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75570F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_HST, xrefs: 0040AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%s%d, xrefs: 0040AE58
%OUTLOOK_MID, xrefs: 0040AEAE

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75570F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75570F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75570F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75570F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75570F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75570F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75570F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75570F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,75570F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,75570F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,75570F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040F315 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

`4u, xrefs: 0040F375, 0040F3A0
time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: `4u$time_cfg
API String ID: 311057483-456741473
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_DOMAIN, xrefs: 0040B41E
%P5DATE, xrefs: 0040B4F2
%FROM_USER, xrefs: 0040B431
%TO_DOMAIN, xrefs: 0040B44B
%FROM_EMAIL, xrefs: 0040B3E9
%M5DATE, xrefs: 0040B50F
%TO_EMAIL, xrefs: 0040B473
%TO_HASH, xrefs: 0040B4B0
%TO_USER, xrefs: 0040B488
%DATE, xrefs: 0040B4D2
%s@%s, xrefs: 0040B461

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 028F1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 028F202D
GetSystemInfo.KERNEL32(?), ref: 028F204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 028F206A
GetProcAddress.KERNEL32(00000000), ref: 028F2071
GetCurrentProcess.KERNEL32(?), ref: 028F2082
GetTickCount.KERNEL32 ref: 028F2230

Part of subcall function 028F1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 028F1E7C

Strings

work_srv, xrefs: 028F20C5
flags_upd, xrefs: 028F20A5, 028F20AA, 028F20E3
localcfg, xrefs: 028F2091, 028F2098, 028F20AB, 028F20E4, 028F20F3, 028F2119, 028F2138, 028F214E, 028F2166, 028F2183, 028F219B, 028F21B7, 028F21D7
hi_id, xrefs: 028F217D, 028F2182, 028F219A

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 8a14d01e93f3fbc83d38237ce3517d49e70f94e148b6c56a952fce444b49da1b
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 2551F578500348AFE370AF698C84F67BBECEB54708F00091DFB9AC2151D7B4A594CB66

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7568EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7568EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 028F3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 028F3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 028F3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 028F3095
RtlAllocateHeap.NTDLL(00000000), ref: 028F30B6
htons.WS2_32(00000035), ref: 028F30EF
inet_addr.WS2_32(?), ref: 028F30FA
gethostbyname.WS2_32(?), ref: 028F310D
HeapFree.KERNEL32(00000000), ref: 028F314D

Strings

iphlpapi.dll, xrefs: 028F3062, 028F3067, 028F3077

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 2cfb970782c5a98315e26e3a36644dce4846150299471c8321f284652b8fadf6
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 3B31D63DA00246ABDB919BB8DC48BAE77B8EF04364F1441A5FA1CE3290DB74D581CB58

Function 028F958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 028F95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 028F95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 028F95DC
wsprintfA.USER32 ref: 028F9635
wsprintfA.USER32 ref: 028F9673
wsprintfA.USER32 ref: 028F96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 028F9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 028F978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 028F97D8

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: bad65a179705288cdd008f3146ab9e930d9b3d264e906bb23131800287587f11
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: EFA18ABA90020CEBEB61DFA4CC85FDA3BADEB04745F104026FA15E2161E7B5D584CFA5

Function 028FF57C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(028FCC84), ref: 028FF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 028FF5CE
closesocket.WS2_32(00000000), ref: 028FF5DC

Strings

time_cfg, xrefs: 028FF58A
`4u, xrefs: 028FF5DC, 028FF607

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: `4u$time_cfg
API String ID: 311057483-456741473
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: edd1a05421d0011df7bcc7a51c694982ec422122722e6c5fd49963153700ff60
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: C6316D7990011CABDB109FA5DC849EE7BBCEF88310F104566FB09D3190E7748A81CBA5

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,755723A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75568A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 028F6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 028F67C3
htonl.WS2_32(?), ref: 028F67DF
htonl.WS2_32(?), ref: 028F67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 028F68F1
ExitProcess.KERNEL32 ref: 028F69BC

Strings

localcfg, xrefs: 028F6994
except_info, xrefs: 028F698F

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: f50938b33fa677d94035177f78bac81ec05b5e84fc475984266d0da83c5a5bec
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: D3617E71A50208AFDB609FB4DC45FEA77E9FB08300F14816AFA6DD2161EB759990CF14

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 028F2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 028F2FA1
LoadLibraryA.KERNEL32(?), ref: 028F2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 028F2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 028F3000
RtlAllocateHeap.NTDLL(00000000), ref: 028F3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 028F3032

Strings

dnsapi.dll, xrefs: 028F2F90

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: f75db398d28921d53b0d5684f4482d25648a7b7ab05bd2ce47ca5a1aa804f27a
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 1D21A479D4022ABBCB619B54DC44AEEBBBCEF48B10F014461FA05E7540D7B49A8187D4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 028F99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 028F9A18
GetThreadContext.KERNEL32(?,?), ref: 028F9A52
TerminateProcess.KERNEL32(?,00000000), ref: 028F9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 028F9A98
SetThreadContext.KERNEL32(?,00010002), ref: 028F9AB5
ResumeThread.KERNEL32(?), ref: 028F9AC2

Strings

D, xrefs: 028F9A10

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 268d167c9d51bbdf625b2873ac0bc633711d23003709495c0f5f18eb1bde802f
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 63216BB5E01229BBDB619BA1DC09FEF7BBCEF04754F004061FA19E1050E7718A54CBA4

Function 028F1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 028F1C18
LoadLibraryA.KERNEL32(004102C8), ref: 028F1C26
GetProcessHeap.KERNEL32 ref: 028F1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 028F1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 028F1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 028F1D02
FreeLibrary.KERNEL32(?), ref: 028F1D0B

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 173e9756039abe2e08ad3f2097c2bad48f20e3c076585d9227a9f1f3a0779b46
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: BF31723AD00209FFCB519FA4DC8C8AEBBB5EB45705B24407AE609E2110D7B55D80DBA4

Function 028F6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 028F6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 028F6D22
GetLastError.KERNEL32 ref: 028F6DA7
CloseHandle.KERNEL32(?), ref: 028F6DB5
GetLastError.KERNEL32 ref: 028F6DD6
DeleteFileA.KERNEL32(?), ref: 028F6DE7
GetLastError.KERNEL32 ref: 028F6DFD

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 385f6daf59ffe8c6267a50972132fdaf3004358fae726c8ea0cfcd4fcc6bbbe7
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: C231DF7E900249BFCB41AFA49D44ADE7F7DEB48310F148265E321E3220E771A6558B62

Function 028F6F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\sugxygo,028F7043), ref: 028F6F4E
GetProcAddress.KERNEL32(00000000), ref: 028F6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 028F6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 028F6F92

Strings

\\.\pipe\sugxygo, xrefs: 028F6F37
C:\Windows\SysWOW64\, xrefs: 028F6F30, 028F6F38, 028F6F65, 028F6F6C, 028F6F7A, 028F6F85, 028F6F91, 028F6FA9, 028F6FC6, 028F6FEC

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\sugxygo
API String ID: 1082366364-1981845078
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 28e6046da452fc21e8c3fd76dac1042c9ceb0b1867c0985cc21e59f9ba1ca2c5
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 2C21F22D74035039F7A257359C88FBB2B4C8F92724F1840A5FA08D59D0EBD984D6866E

Function 028FAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 028FAAE5

Strings

, xrefs: 028FABB3
localcfg, xrefs: 028FAD72

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: ec9dc151b3a96945f8385c4782c3e00da7f69e88725b670bdbba27de9455338a
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 24712D7EA00308AAEFA99B58DC85FEE376D9B00779F244026FB0CE60D0DF6255C48B55

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 028FE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 028FDF6C: GetCurrentThreadId.KERNEL32 ref: 028FDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 028FE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,028F6128), ref: 028FE950
lstrcmp.KERNEL32(?,00000008), ref: 028FE989

Strings

A, xrefs: 028FE9A0
A, xrefs: 028FE960, 028FE965
A, xrefs: 028FE8C6, 028FE8CD, 028FE936, 028FE998

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: fc6c057f42852865bc82651108fd2559273f32e673b01c1e7d0cc29ee93d95c0
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: D131743DB007159BDBB18F24C884B667BE5EB05716F10852AEB59C7561D374E480CB62

Function 028F6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 028F6E19

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 52135d97e155a4a187af746819e182dd37fd3bee87786874f5aacbecad53cd8a
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 89215B7F204129BFDB509BA4FC48EDF3FADDB49264B208521F616D1090FB71DA009674

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 028F92CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 028F92E2
wsprintfA.USER32 ref: 028F9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 028F9375
lstrlen.KERNEL32(?,?,00000000), ref: 028F9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 028F9394
CloseHandle.KERNEL32(00000000), ref: 028F939B

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 95c294ca55d2a0656566804f49d1a6b5a4da57a446fd4565cf98288815fcc358
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 031172BA6401147BE7606735EC0DFEF3B6EDFC8B10F0080A5BB09E5090EAB44A418A65

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75570F10,?,00000000,0040E538,?,75570F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 028FC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 028FC6B4
InterlockedIncrement.KERNEL32(028FC74B), ref: 028FC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,028FC747), ref: 028FC728
CloseHandle.KERNEL32(00000000,?,028FC747,00413588,028F8A77), ref: 028FC733

Strings

localcfg, xrefs: 028FC544

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 90e24a1ecbcc5c4c0c32d9ea1ac32b5289a6cc5c8856601db22a08eedbec3d98
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 80515EB9A04B498FD7A4CF29C5C462ABBE9FB48304B50593FE28BC7A91D774E544CB10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75570F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75570F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75570F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75570F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75570F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75570F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75570F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe
API String ID: 124786226-680064073
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 028F71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 028F71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 028F7228
LocalFree.KERNEL32(?,?,?), ref: 028F7286
wsprintfA.USER32 ref: 028F729D

Strings

|, xrefs: 028F721A

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: b76cd740951ae9538ff1978c1a5c533c38868d45d2ca7abdb24298d05a93da76
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 2E31297AA00208BFDB41DFA8DC45BDA7BACEF04314F14C066FA59DB240EB75D6488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 028FB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 028FB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 028FB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 028FB548
GetTimeZoneInformation.KERNEL32(?), ref: 028FB590
wsprintfA.USER32 ref: 028FB61E

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: e8c36375da4d78e987939ad83942909bc71842b5e23e1e532a884b83eaae3e1c
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 3B511FB5D0021DAACF54DFD5D8885EEBBB9BF48304F10816AF605A6150E7B84AC9CF98

Function 028F62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 028F6303
LoadLibraryA.KERNEL32(?), ref: 028F632A
GetProcAddress.KERNEL32(00000000,?), ref: 028F63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 028F6405

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 3ea3e0d544a7eabf2e8b575769a41370c174826a4dce9e8d086d48b9064ff4dc
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 7F41607DA00229EFDB54CF58C884BA9B7B8FF14358F188269EA29D7250E771E940CB50

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75570F18,00000000,?,75570F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75570F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75570F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 028F93AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 028F93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 028F93CD
CharToOemA.USER32(?,?), ref: 028F93DB
wsprintfA.USER32 ref: 028F9410

Part of subcall function 028F92CB: GetTempPathA.KERNEL32(00000400,?), ref: 028F92E2
Part of subcall function 028F92CB: wsprintfA.USER32 ref: 028F9350
Part of subcall function 028F92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 028F9375
Part of subcall function 028F92CB: lstrlen.KERNEL32(?,?,00000000), ref: 028F9389
Part of subcall function 028F92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 028F9394
Part of subcall function 028F92CB: CloseHandle.KERNEL32(00000000), ref: 028F939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 028F9448

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 9aed107310b5f0a6bb6408ae491d86d9e2fedeeadb05cb4d710ea8d59c1d5a88
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 80015EFA9001187BDB61A7659D89FDF3B7CDB95701F0040A2BB49E2080EAB496C58F75

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 028F28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 028F28FA
gethostbyname.WS2_32(u6A), ref: 028F2906

Strings

time_cfg, xrefs: 028F28EB
u6A, xrefs: 028F28EC, 028F28F9, 028F2905

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: f0c1707e07e2edf6cd1c7e93afa899d9309019fb8cc41aa7932aa59b74fd0a37
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: A4E0C2386141218FCB808B2CF848AD537E4EF0A230F008180F948C32A4C734DCC09740

Function 00402684 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684
W4u, xrefs: 00402693

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$W4u
API String ID: 1594361348-4149107023
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 028FD7D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 028FD7D3
Sleep.KERNEL32(000003E8), ref: 028FD7DE
ExitProcess.KERNEL32 ref: 028FD7EA

Strings

`4u, xrefs: 028FD7D3

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: `4u
API String ID: 2012141568-6339388
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: 8ffe05a623409c77bccfd4c008ce85f8e03393b8eb6b08ba275d0cf0b65cabd0
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: E8C04C34801208DBC7412B74FC4C98C3F65AB08301710C170A10A91070CAB045508A29

Function 028F69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 028F69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 028F6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 028F6A3A
CloseHandle.KERNEL32(000000FF), ref: 028F6BD8

Part of subcall function 028FEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,028F1DCF,?), ref: 028FEEA8
Part of subcall function 028FEE95: HeapFree.KERNEL32(00000000), ref: 028FEEAF

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 52c45dcc7c0c1718de47be88b45dc2693e9d5f59e2a0afdd1dac08ed519c3fe2
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 13711C7990022DEFDF11DFA4CD809EEBBB9FB04354F10466AE625E6190E7309E91DB50

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 028FE2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,028FE50A,00000000,00000000,00000000,00020106,00000000,028FE50A,00000000,000000E4), ref: 028FE319
RegSetValueExA.ADVAPI32(028FE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 028FE38E
RegDeleteValueA.ADVAPI32(028FE50A,?,?,?,?,?,000000C8,004122F8), ref: 028FE3BF
RegCloseKey.ADVAPI32(028FE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,028FE50A), ref: 028FE3C8

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 99b5c0802cfd056bdb623dcbff66f79fc5e4f5eb3d646c2f1d780565cb520b90
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 79215379A0021DBBDF609FA5EC89EDE7F79EF08750F048061FA08E6160E7718A54DB91

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 028F41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 028F421F
GetLastError.KERNEL32 ref: 028F4229
WaitForSingleObject.KERNEL32(?,?), ref: 028F423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 028F424D

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 60bad7e3cb5b37c011f43a8c08e109fc81a0a228a425e8d4125343e6510c541e
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: E901C876511109AFDF41DF90ED84BEF7BACEB08256F108462FA05E2050E770DA548BB6

Function 028F417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 028F41AB
GetLastError.KERNEL32 ref: 028F41B5
WaitForSingleObject.KERNEL32(?,?), ref: 028F41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 028F41D9

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: db835cb029891e6d0654933540308e46485d48af3587e5bf7af2935c092b3e80
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 2301E97A51110EABDF01DF90ED84BEF7B6CEB18259F004062FA05E2050D770AA948BB5

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 028FE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 028FE066

Strings

A, xrefs: 028FE07F
A, xrefs: 028FE036
A, xrefs: 028FE037, 028FE03C

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 20de0414a7b37f62fb85f3b7274d0d48155d8cec20561067ad11e8efb3ff62dc
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 19F06D3A2007069BCB60CF25D884A82B7E9FB89325B548B2AE658C3870D374A498CB55

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 028F8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 028F83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 028F8477

Part of subcall function 028F69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 028F69E5
Part of subcall function 028F69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 028F6A26
Part of subcall function 028F69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 028F6A3A

Part of subcall function 028FEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,028F1DCF,?), ref: 028FEEA8
Part of subcall function 028FEE95: HeapFree.KERNEL32(00000000), ref: 028FEEAF

Strings

C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 028F848C, 028F84A1

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe
API String ID: 359188348-680064073
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 364258fff5a67c2405309e9d50cee3dd5303b1159220de3206e66320c0e7359f
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 7D4160BE900109BFEB50EBA49E80EFF776DEB14344F1484AAE708D6150F7B05A948F65

Function 028FAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 028FAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 028FB00D

Part of subcall function 028FAF6F: gethostname.WS2_32(?,00000080), ref: 028FAF83
Part of subcall function 028FAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 028FAFE6

Part of subcall function 028F331C: gethostname.WS2_32(?,00000080), ref: 028F333F
Part of subcall function 028F331C: gethostbyname.WS2_32(?), ref: 028F3349

Part of subcall function 028FAA0A: inet_ntoa.WS2_32(00000000), ref: 028FAA10

Strings

%OUTLOOK_BND_, xrefs: 028FB076, 028FB07B, 028FB0BE, 028FB0DD

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 491063f46591598ec75f94777c890be842021f5b7a033120b6adb93be54ec65d
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 07418E7A90020CABCB25EFA4DC45EEE3BADFF48304F144426FA28D2151EB75E6848F55

Function 028F9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 028F9536
Sleep.KERNEL32(000001F4), ref: 028F955D

Strings

, xrefs: 028F94D9

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: d5991c9526e425f0ba0d4f3ed0a5fe6376decb1107a755a7f9ba6ecca8b41c47
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 5841297DC08389AEEBB68B68D89C7A63FA49B16318F1440E5D78AD71A2D7744980C711

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 028FBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 028FB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 028FBA3A
InterlockedIncrement.KERNEL32(?), ref: 028FBA94
GetTickCount.KERNEL32 ref: 028FBB79
GetTickCount.KERNEL32 ref: 028FBB99
InterlockedIncrement.KERNEL32(?), ref: 028FBE15
closesocket.WS2_32(00000000), ref: 028FBEB4

Strings

%FROM_EMAIL, xrefs: 028FBC7D

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 8a08ba3e5e03d264e3b02db3a8ec53b5e5f9690c6be4a858c9c518e3015d2ace
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: B2317C79500248DFDFA5DFA4DC84AE9B7A9EB48708F20405AFB28D2160EB34E685CF11

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 028F709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 028F70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 028F70F4

Strings

|, xrefs: 028F70E6

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d0e8d3b5c3d9bf3287051d2eb6dd9176fa9972cc57c0760b9af5d73c8d6f9046
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 6A110C7A90011CEBEF51CFD4DC84ADEF7BDAB04715F1441A6E605E6194E7709B88CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7568EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 028F3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 028F2F88: GetModuleHandleA.KERNEL32(?), ref: 028F2FA1
Part of subcall function 028F2F88: LoadLibraryA.KERNEL32(?), ref: 028F2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 028F31DA
HeapFree.KERNEL32(00000000), ref: 028F31E1

Memory Dump Source

Source File: 0000000C.00000002.1461678796.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28f0000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 10919bc75b8b179ab4e02bf1e51068fb5f6cfdfe094e254e83f6842aa2c58a99
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 0451B03990028AEFCB41DF64D8849FAB775FF15305F1441A9EE9AC7210E732DA59CB90

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,755723A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.1460336110.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_ubezyssm.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: svchost.exePID: 8000, Parent PID: 7844COMMON

Execution Graph

Execution Coverage:	15.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.8%
Total number of Nodes:	1798
Total number of Limit Nodes:	18

Executed Functions

Function 0047C913 Relevance: 116.9, APIs: 45, Strings: 21, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0047CA4E
closesocket.WS2_32(?), ref: 0047CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0047CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0047CCB4
WriteFile.KERNEL32(0047A4B3,?,-000000E8,?,00000000), ref: 0047CCDC
CloseHandle.KERNEL32(0047A4B3), ref: 0047CCED
wsprintfA.USER32 ref: 0047CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0047CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0047CD89
CloseHandle.KERNEL32(?), ref: 0047CD98
CloseHandle.KERNEL32(?), ref: 0047CD9D
DeleteFileA.KERNEL32(?), ref: 0047CDC4
CloseHandle.KERNEL32(0047A4B3), ref: 0047CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0047CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0047CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0047D033
lstrcatA.KERNEL32(?,03900108), ref: 0047D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0047D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0047D171
WriteFile.KERNEL32(00000000,0390012C,?,?,00000000), ref: 0047D195
CloseHandle.KERNEL32(00000000), ref: 0047D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0047D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0047D231
lstrcatA.KERNEL32(?,03900108,?,?,?,?,?,?,?,00000100), ref: 0047D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0047D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0047D2C7
WriteFile.KERNEL32(00000000,0390012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0047D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0047D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0047D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0047D372
lstrcatA.KERNEL32(?,03900108,?,?,?,?,?,?,?,00000100), ref: 0047D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0047D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0047D408
WriteFile.KERNEL32(00000000,0390012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0047D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0047D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0047D45B
CreateProcessA.KERNEL32(?,00480264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0047D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0047D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0047D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0047D513
closesocket.WS2_32(?), ref: 0047D56C
Sleep.KERNEL32(000003E8), ref: 0047D577
ExitProcess.KERNEL32 ref: 0047D583
wsprintfA.USER32 ref: 0047D81F

Part of subcall function 0047C65C: send.WS2_32(00000000,?,00000000), ref: 0047C74B

closesocket.WS2_32(?), ref: 0047DAD5

Strings

4, xrefs: 0047D9F7
wtm_r, xrefs: 0047C97F
flags_upd, xrefs: 0047CE4A
\, xrefs: 0047D3A7
time_cfg, xrefs: 0047C95B, 0047C962, 0047C971, 0047C984
except_info, xrefs: 0047D8CD, 0047D8D2, 0047D8FB
\, xrefs: 0047D39D
srv_time, xrefs: 0047CABB
@, xrefs: 0047D754
local_time, xrefs: 0047CACD
work_srv, xrefs: 0047D607, 0047D60F, 0047D62C
C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 0047CC10, 0047CCF3, 0047D975, 0047D98E
localcfg, xrefs: 0047CA89, 0047CA93, 0047CAC0, 0047CAD2, 0047CE4F, 0047CE6F, 0047D8D3, 0047D8FC
wtm_c, xrefs: 0047C956
.dat, xrefs: 0047D0D7, 0047D138, 0047D1AE, 0047D1D4, 0047D28E, 0047D308, 0047D3CF, 0047D441
.sys, xrefs: 0047D0CC
`4u, xrefs: 0047CA4E, 0047CB63, 0047D56C, 0047DAD5
lid_file_upd, xrefs: 0047CE6A
X H, xrefs: 0047C927, 0047C93C, 0047C9BE
wtm_w, xrefs: 0047C96C
drivers\, xrefs: 0047D067

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe$X H$\$\$`4u$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-1287820861
Opcode ID: e3844fae091719ed826f7818158a2ae2aadabb4ef61bb74b279b42cdd91e11c8
Instruction ID: 2901c77dd115058153eab57c4eed5e8ae374308cc4fec1217d4d6c9a21907cdb
Opcode Fuzzy Hash: e3844fae091719ed826f7818158a2ae2aadabb4ef61bb74b279b42cdd91e11c8
Instruction Fuzzy Hash: CEB2C571D00208AFEB209F64DD89FEE77B8AF08304F1485AFF60DA6251E7785A45CB59

Function 00479A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00479A7F
SetErrorMode.KERNELBASE(00000003), ref: 00479A83
SetUnhandledExceptionFilter.KERNEL32(00476511), ref: 00479A8A

Part of subcall function 0047EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0047EC5E
Part of subcall function 0047EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0047EC72
Part of subcall function 0047EC54: GetTickCount.KERNEL32 ref: 0047EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00479AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00479ABA
GetCommandLineA.KERNEL32 ref: 00479AFD
lstrlenA.KERNEL32(?), ref: 00479B99
ExitProcess.KERNEL32 ref: 00479C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00479CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00479D7A
lstrcatA.KERNEL32(?,?), ref: 00479D8B
lstrcatA.KERNEL32(?,0048070C), ref: 00479D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00479DED
DeleteFileA.KERNEL32(00000022), ref: 00479E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00479E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00479EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00479ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00479F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00479F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00479F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00479FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00479FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00479FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0047A038
lstrcatA.KERNEL32(00000022,00480A34), ref: 0047A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0047A072
lstrcatA.KERNEL32(00000022,00480A34), ref: 0047A08D
wsprintfA.USER32 ref: 0047A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0047A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0047A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0047A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0047A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0047A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0047A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0047A1B6
GetCommandLineA.KERNEL32 ref: 0047A1E5

Part of subcall function 004799D2: lstrcpyA.KERNEL32(?,?,00000100,004822F8,00000000,?,00479E9D,?,00000022,?,?,?,?,?,?,?), ref: 004799DF
Part of subcall function 004799D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00479E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00479A3C
Part of subcall function 004799D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00479E9D,?,00000022,?,?,?), ref: 00479A52

lstrlenA.KERNEL32(?), ref: 0047A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0047A3B7
GetLastError.KERNEL32 ref: 0047A3ED
Sleep.KERNEL32(000003E8), ref: 0047A400
DeleteFileA.KERNELBASE(004833D8), ref: 0047A407
CreateThread.KERNELBASE(00000000,00000000,0047405E,00000000,00000000,00000000), ref: 0047A42C
WSAStartup.WS2_32(00001010,?), ref: 0047A43A
CreateThread.KERNELBASE(00000000,00000000,0047877E,00000000,00000000,00000000), ref: 0047A469
Sleep.KERNELBASE(00000BB8), ref: 0047A48A
GetTickCount.KERNEL32 ref: 0047A49F
GetTickCount.KERNEL32 ref: 0047A4B7
Sleep.KERNELBASE(00001A90), ref: 0047A4C3

Strings

%X%08X, xrefs: 0047A0B0
P, xrefs: 00479DAA
", xrefs: 0047A189
jlxopxf, xrefs: 0047A389, 0047A397
", xrefs: 00479EDB
", xrefs: 0047A078
\, xrefs: 00479D0C
C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 0047A1D9
D, xrefs: 00479F8E

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe$D$P$\$jlxopxf
API String ID: 2089075347-1873499730
Opcode ID: d13d5944137c2342fe7b45b79fc0fd1edc865d32b48dda00f0f9985f79cce2f5
Instruction ID: d36f79320be159004e05fcc9cc7e088db65211d3bfbacb404d06bacd0aec26c0
Opcode Fuzzy Hash: d13d5944137c2342fe7b45b79fc0fd1edc865d32b48dda00f0f9985f79cce2f5
Instruction Fuzzy Hash: 2A5294B1C40259AFDB21DFA1DC49EEF77BCAB04304F1489ABF50DA2141D7789E488B69

Function 0047199C Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004719B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,00471E9E), ref: 004719BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004719E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004719ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004719F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,00471E9E), ref: 00471A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00471E9E), ref: 00471A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00471E9E), ref: 00471A36
GetAdaptersInfo.IPHLPAPI(00000000,00471E9E,?,?,?,?,00000001,00471E9E), ref: 00471A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,00471E9E,?,?,?,?,00000001,00471E9E), ref: 00471A5A
GetAdaptersInfo.IPHLPAPI(00000000,00471E9E,?,?,?,?,00000001,00471E9E), ref: 00471A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00471E9E), ref: 00471A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00471E9E), ref: 00471AA4

Strings

localcfg, xrefs: 004719A3
123.45.67.89, xrefs: 004719A6
Iphlpapi.dll, xrefs: 004719B7
GetBestInterface, xrefs: 004719EF
GetAdaptersInfo, xrefs: 004719DC
W4u, xrefs: 004719B1
GetIfEntry, xrefs: 004719E4

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$W4u
API String ID: 293628436-1619806614
Opcode ID: 5b76512449c27cdf4ba873a3d0c678ccafb4ef8ade812f75bd9b6f951fb63ac8
Instruction ID: bc67ef2ba9f1707d93e3c39a97a75876efb62ffb72a2c4e0a37ffdc601b95c92
Opcode Fuzzy Hash: 5b76512449c27cdf4ba873a3d0c678ccafb4ef8ade812f75bd9b6f951fb63ac8
Instruction Fuzzy Hash: 95317E32D11209AFCB519FE8CC8C8AFBBB9EF44711B24897BE505A2220D7784E448B58

Function 00477A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00477ABA
GetUserNameA.ADVAPI32(?,?), ref: 00477ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0048070C,?,?,?), ref: 00477B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00477B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00477B59
EqualSid.ADVAPI32(?,00000022), ref: 00477B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00477B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00477B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00477B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 00477BAB
LocalFree.KERNEL32(00000000), ref: 00477BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00477FC9,?,00000000), ref: 00477BCE

Strings

D, xrefs: 00477B0C
C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 00477CE2, 00477D0F, 00477D23, 00477D24

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe$D
API String ID: 2976863881-1525390353
Opcode ID: 17eb90adeb8a5de7657ab116c102e2b4e48a9c9a41de22e02ff56569fa5047ad
Instruction ID: 8457144d6baccd9a2a5129ebf9f5453442cdd8bdf6ce1e40e199f65abf4de067
Opcode Fuzzy Hash: 17eb90adeb8a5de7657ab116c102e2b4e48a9c9a41de22e02ff56569fa5047ad
Instruction Fuzzy Hash: D9A19371904219AFDF218FA4DC88FEFBBB8FF45304F54846AE509E2250D7399A45CB68

Function 00477809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0047782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00477866
GetLengthSid.ADVAPI32(?), ref: 00477878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0047789A
GetSecurityDescriptorOwner.ADVAPI32(?,00477F63,?), ref: 004778B8
EqualSid.ADVAPI32(?,00477F63), ref: 004778D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004778E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004778F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00477901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00477910
LocalFree.KERNEL32(00000000), ref: 00477917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00477933
GetAce.ADVAPI32(?,00000000,?), ref: 00477963
EqualSid.ADVAPI32(?,00477F63), ref: 0047798A
DeleteAce.ADVAPI32(?,00000000), ref: 004779A3
EqualSid.ADVAPI32(?,00477F63), ref: 004779C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00477A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00477A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00477A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00477A79
LocalFree.KERNEL32(00000000), ref: 00477A87

Strings

D, xrefs: 0047785C

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 28b8b7358639dc85e922a34e2978c8729487161ad2d56d0d33a8752eeeb08fda
Instruction ID: 3a96f383de1411e3ad2cefab3319860e121d8184a39c4bc9684214afe67bbc29
Opcode Fuzzy Hash: 28b8b7358639dc85e922a34e2978c8729487161ad2d56d0d33a8752eeeb08fda
Instruction Fuzzy Hash: 838171B1D05109ABEB11CFA4DD44FEFBBB8EF09344F54846AE609E2250D7398A45CF68

Function 00478328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004783F3
RegQueryValueExA.KERNELBASE(00480750,?,00000000,?,00478893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00478414
RegSetValueExA.KERNELBASE(00480750,?,00000000,00000004,00478893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00478441
RegCloseKey.ADVAPI32(00480750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0047844A

Strings

localcfg, xrefs: 00478348
C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 004785C8, 004785D5, 004785E5

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe$localcfg
API String ID: 237177642-1805313226
Opcode ID: 8ad00515f67c0a6b3965e447f31f6ff6e407fbd95fab763de7884023439a0978
Instruction ID: 089b5699910be3b0e75655cd1e1ac37617bebd05a56766a18811e599025131ad
Opcode Fuzzy Hash: 8ad00515f67c0a6b3965e447f31f6ff6e407fbd95fab763de7884023439a0978
Instruction Fuzzy Hash: 98C1D7B1D40109BEEB11ABA5DD89EFF7B7CEB05304F10846FF509A2151EB784E449B29

Function 00471D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 00471DC6
GetSystemInfo.KERNELBASE(?), ref: 00471DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00471E03
GetProcAddress.KERNEL32(00000000), ref: 00471E0A
GetCurrentProcess.KERNEL32(?), ref: 00471E1B
GetTickCount.KERNEL32 ref: 00471FC9

Part of subcall function 00471BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00471C15

Strings

localcfg, xrefs: 00471E2A, 00471E31, 00471E44, 00471E7D, 00471E8C, 00471EB2, 00471ED1, 00471EE7, 00471EFF, 00471F1C, 00471F34, 00471F50, 00471F70
net_type, xrefs: 00471E87
start_srv, xrefs: 00471E6C
flags_upd, xrefs: 00471E3E, 00471E43, 00471E7C
IsWow64Process, xrefs: 00471DF2
hi_id, xrefs: 00471F16, 00471F1B, 00471F33
lid_file_upd, xrefs: 00471E25
born_date, xrefs: 00471EAD, 00471ECC
kernel32, xrefs: 00471DF7
work_srv, xrefs: 00471E5E
loader_id, xrefs: 00471F4B, 00471F6B

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 7be09c6d556a13f16e410371184e1b3b1a3cf0b46dc772ebdd08ff954b4cda97
Instruction ID: 70e3e440b62223f9e0f15482a7990ae20a85d4943da666683d16ac0963720c88
Opcode Fuzzy Hash: 7be09c6d556a13f16e410371184e1b3b1a3cf0b46dc772ebdd08ff954b4cda97
Instruction Fuzzy Hash: 4B51B6B05043446FE370AF7A8C85FAB7AECEB45708F048D1FF94942252D77DA908876A

Function 004773FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75570F10,00000000), ref: 00477472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75570F10,00000000), ref: 004774F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75570F10,00000000), ref: 00477528
___ascii_stricmp.LIBCMT ref: 0047764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75570F10,00000000), ref: 004776E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00477706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75570F10,00000000), ref: 00477717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75570F10,00000000), ref: 00477745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75570F10,00000000), ref: 004777EF

Part of subcall function 0047F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004822F8,000000C8,00477150,?), ref: 0047F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0047778F
RegCloseKey.KERNELBASE(?), ref: 004777E6

Strings

", xrefs: 00477599

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 558950c8491d7f04026efe547201c94d1afcb6808862d6cf4fef324747699d81
Instruction ID: 941587d9a6a1e747b172c411c5301d08d3f955772904c40047dca0c525a7c418
Opcode Fuzzy Hash: 558950c8491d7f04026efe547201c94d1afcb6808862d6cf4fef324747699d81
Instruction Fuzzy Hash: FBC1F271904209AFDB219BA5DC45FEF7BB9EF05310F5084ABF508E6190EB389E448B68

Function 0047675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75570F10,00000000), ref: 0047677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75570F10,00000000), ref: 0047679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75570F10,00000000), ref: 004767B0
SetFileAttributesA.KERNEL32(?,00000002,?,75570F10,00000000), ref: 004767BF
GetFileSize.KERNEL32(000000FF,00000000,?,75570F10,00000000), ref: 004767D3
ReadFile.KERNELBASE(000000FF,?,00000040,00478244,00000000,?,75570F10,00000000), ref: 00476807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0047681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75570F10,00000000), ref: 0047683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0047685C
ReadFile.KERNEL32(000000FF,?,00000028,00478244,00000000,?,75570F10,00000000), ref: 0047688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75570F10,00000000), ref: 00476906
ReadFile.KERNEL32(000000FF,?,00000000,00478244,00000000,?,75570F10,00000000), ref: 0047691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,75570F10,00000000), ref: 00476971

Part of subcall function 0047EC2E: GetProcessHeap.KERNEL32(00000000,'G,00000000,0047EA27,00000000), ref: 0047EC41
Part of subcall function 0047EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0047EC48

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 77b6298f8df2dab931a6f93ef4f27a9556f0313231888b966d858ed9222e98b9
Instruction ID: d5dfdebcc1c5d1a27be46bafbc27926b96efe761e57af965439eba407820eef6
Opcode Fuzzy Hash: 77b6298f8df2dab931a6f93ef4f27a9556f0313231888b966d858ed9222e98b9
Instruction Fuzzy Hash: 05716BB1C0061DEFDF10DFA5CC809EEBBB9FB04314F11856AE519A6290E7349E56CB54

Function 0047F315 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(0047CA1D), ref: 0047F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0047F367
closesocket.WS2_32(00000000), ref: 0047F375

Strings

time_cfg, xrefs: 0047F323
`4u, xrefs: 0047F375, 0047F3A0

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: `4u$time_cfg
API String ID: 311057483-456741473
Opcode ID: 6d8f3ee2928ec432dc9c69c9b1fed40d3b820e61bbe22d5b8af0f73b5b633d07
Instruction ID: 112c4f6028108a9c7c0ca11fa7badacb05b29c6e82b6b960ecb90165fb6d9444
Opcode Fuzzy Hash: 6d8f3ee2928ec432dc9c69c9b1fed40d3b820e61bbe22d5b8af0f73b5b633d07
Instruction Fuzzy Hash: 4531A072900118ABDB10DFA5DC89DEF7BBCEF48314F10857AF918D3151E7748A498BA9

Function 0047405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00474070
ExitProcess.KERNEL32 ref: 00474121

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 0f9c7b60cf26cb16e73eb0a3e2680b7f7382d8bee988cc42bd495b77d4eac063
Instruction ID: e1b9ef19e649063b4fcb0a37cae3d12e31770fd390ff0925688cb62ac050e6d7
Opcode Fuzzy Hash: 0f9c7b60cf26cb16e73eb0a3e2680b7f7382d8bee988cc42bd495b77d4eac063
Instruction Fuzzy Hash: F551B471D00208BADB20ABA19D45FFF7B7CEF55754F00806AF608B6181E7388E45D769

Function 00472D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,755723A0,?,00000000,00472F01,?,004720FF,00482000), ref: 00472D3A
LoadLibraryA.KERNEL32(?), ref: 00472D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00472D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 00472D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00472D99
HeapAlloc.KERNEL32(00000000), ref: 00472DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00472DCB

Strings

dnsapi.dll, xrefs: 00472D29
DnsQuery_A, xrefs: 00472D5B

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: 20c70c735b4e78b002384f1e02500073e2f4a84ad222854f335c8c22fe4b7de0
Instruction ID: 77b3ecf01f81b0c2967bd7bcd86d2e7492df460b31997044a0444556289fc8df
Opcode Fuzzy Hash: 20c70c735b4e78b002384f1e02500073e2f4a84ad222854f335c8c22fe4b7de0
Instruction Fuzzy Hash: 8E21A471D00226ABCB619F65DD489EFBBB8EF08B50F108426F909F3210D3B4998587D8

Function 004780C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 0047815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0047A45F,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 00478187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0047A45F,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 004781BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75570F10,00000000), ref: 00478210

Part of subcall function 0047675C: SetFileAttributesA.KERNEL32(?,00000080,?,75570F10,00000000), ref: 0047677E
Part of subcall function 0047675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75570F10,00000000), ref: 0047679A
Part of subcall function 0047675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75570F10,00000000), ref: 004767B0
Part of subcall function 0047675C: SetFileAttributesA.KERNEL32(?,00000002,?,75570F10,00000000), ref: 004767BF
Part of subcall function 0047675C: GetFileSize.KERNEL32(000000FF,00000000,?,75570F10,00000000), ref: 004767D3
Part of subcall function 0047675C: ReadFile.KERNELBASE(000000FF,?,00000040,00478244,00000000,?,75570F10,00000000), ref: 00476807
Part of subcall function 0047675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0047681F
Part of subcall function 0047675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75570F10,00000000), ref: 0047683E
Part of subcall function 0047675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75570F10,00000000), ref: 0047685C

Part of subcall function 0047EC2E: GetProcessHeap.KERNEL32(00000000,'G,00000000,0047EA27,00000000), ref: 0047EC41
Part of subcall function 0047EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0047EC48

Strings

C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe, xrefs: 00478225, 0047823A

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe
API String ID: 124786226-680064073
Opcode ID: e550f7342ca49a0ba525eb9d2c0fd651ac25ae252fb77f7d61224a78fb433857
Instruction ID: d6cb2d73fe8d7db358d42141507e659187ef626f349f60ae87e30192def2770f
Opcode Fuzzy Hash: e550f7342ca49a0ba525eb9d2c0fd651ac25ae252fb77f7d61224a78fb433857
Instruction Fuzzy Hash: 3F41B3B2941108BFEB10EBA59E89DFF776CDB04304F1489AFF509E2112EA785E448B5D

Function 00471AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00471AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00471AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00471B20

Strings

Iphlpapi.dll, xrefs: 00471ACC
GetAdaptersAddresses, xrefs: 00471AE3

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 1a7ec0c9beebdc9b4b63b429667fc99b6a265ea09c1745c4af36598214ee7b5e
Instruction ID: a0dafcdbfce918990567af4423059987336a3090d4e52281df35ea1312db6a9e
Opcode Fuzzy Hash: 1a7ec0c9beebdc9b4b63b429667fc99b6a265ea09c1745c4af36598214ee7b5e
Instruction Fuzzy Hash: AF110D71E01124AFCB11D7A9CD848DEBB79EB44B10B548497E00DE3221E6346E44D788

Function 0047E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,0047E5F2,00000000,00020119,0047E5F2,004822F8), ref: 0047E3E6
RegQueryValueExA.ADVAPI32(0047E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0047E44E
RegQueryValueExA.ADVAPI32(0047E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0047E482
RegQueryValueExA.ADVAPI32(0047E5F2,?,00000000,?,80000001,?), ref: 0047E4CF
RegCloseKey.ADVAPI32(0047E5F2,?,?,?,?,000000C8,000000E4), ref: 0047E520

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 493fa4a3efe3309c2dd0791e9cbb3a82811c6b84c8102055fe5faeb3e4a8153f
Instruction ID: b336401410952cd036ddd6d701dc1e21300f62823368d7f9dc5f918344b22e4d
Opcode Fuzzy Hash: 493fa4a3efe3309c2dd0791e9cbb3a82811c6b84c8102055fe5faeb3e4a8153f
Instruction Fuzzy Hash: 3A4138B2D0021DBFDF119FE9DC81DEEBBB9EB08304F1485AAE914B2150E3359A158B64

Function 0047F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0047F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0047F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0047F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0047F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0047F2FD

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 7292ba08e512c3b8e84f1d0fdffe31a65678d802f296a94dbc90138b31befe7b
Instruction ID: 71a318ab903c29e6d9918cf85857c2df7fc3fca0b7f85a4d12c9a0d0093dcad5
Opcode Fuzzy Hash: 7292ba08e512c3b8e84f1d0fdffe31a65678d802f296a94dbc90138b31befe7b
Instruction Fuzzy Hash: 64110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00471BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00471AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00471AD4
Part of subcall function 00471AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00471AE9
Part of subcall function 00471AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00471B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00471C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00471C51

Strings

localcfg, xrefs: 00471BE7
hi_id, xrefs: 00471BE5

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 12b30fe51dc277768fa78c273cdc0d8758c75d2f99e10a033fc0355070df9d4b
Instruction ID: 438f2c2b4da0883cb88a798e8bd2b05232ce2c48d7899b90bc2a5f4d57964832
Opcode Fuzzy Hash: 12b30fe51dc277768fa78c273cdc0d8758c75d2f99e10a033fc0355070df9d4b
Instruction Fuzzy Hash: 80018072A40118BFEB51DAECCCC59EFBABCAB44745F10447AEB06E2210D2349E4486A5

Function 00472684 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00472693
gethostbyname.WS2_32(00000001), ref: 0047269F

Strings

time_cfg, xrefs: 00472684
W4u, xrefs: 00472693

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$W4u
API String ID: 1594361348-4149107023
Opcode ID: a3ca3c3e04adbf1bce3bfbbe2bd71980ee666b26351bb3e611b23266ea2616e9
Instruction ID: af5ddcad021d96536e8cfbaeb2d04213a9749c917a21a82e89f10a0f6363d8cf
Opcode Fuzzy Hash: a3ca3c3e04adbf1bce3bfbbe2bd71980ee666b26351bb3e611b23266ea2616e9
Instruction Fuzzy Hash: F4E0C2302144218FCB509B28F848ACA37E5EF06330F01858BF448C32A0C7B8DC808788

Function 00471B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00471AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00471AD4
Part of subcall function 00471AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00471AE9
Part of subcall function 00471AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00471B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00471BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,00471EFD,00000000,00000000,00000000,00000000), ref: 00471BB8

Strings

localcfg, xrefs: 00471B7B

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 4e3e3bacb45522643002c5f23c45409416e7cfa1e8025deb57c961d9921c1e7d
Instruction ID: 80faba16f08a670f3ea94a54e94db5c50a1c43f8b7367a7fe706d4d46b2528d6
Opcode Fuzzy Hash: 4e3e3bacb45522643002c5f23c45409416e7cfa1e8025deb57c961d9921c1e7d
Instruction Fuzzy Hash: A2018BB6D00108BFEB109BE9CC819EFFABCAB48754F154566A705E3150D5706E0857A1

Function 0047EC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0047EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0047EC0A,00000000,80000001,?,0047DB55,7FFF0001), ref: 0047EBAD
Part of subcall function 0047EBA0: HeapSize.KERNEL32(00000000,?,0047DB55,7FFF0001), ref: 0047EBB4

GetProcessHeap.KERNEL32(00000000,'G,00000000,0047EA27,00000000), ref: 0047EC41
RtlFreeHeap.NTDLL(00000000), ref: 0047EC48

Strings

'G, xrefs: 0047EC2F, 0047EC37, 0047EC3E

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID: 'G
API String ID: 1305341483-1276045452
Opcode ID: 0161c789551d16a4bef1a1f23aa9abbc3145bf571dc150b3e4be51d4b7f15201
Instruction ID: 0288fa894d6c2de1a21163e09608e131679676efa493e6303bbbb93763df7b80
Opcode Fuzzy Hash: 0161c789551d16a4bef1a1f23aa9abbc3145bf571dc150b3e4be51d4b7f15201
Instruction Fuzzy Hash: 5DC012324162306BC5912761BC1DFDF6F189F4AB21F0D494EF409A6154C764584047E9

Function 0047E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0047DD05: GetTickCount.KERNEL32 ref: 0047DD0F
Part of subcall function 0047DD05: InterlockedExchange.KERNEL32(004836B4,00000001), ref: 0047DD44
Part of subcall function 0047DD05: GetCurrentThreadId.KERNEL32 ref: 0047DD53

GetFileSize.KERNEL32(00000000,00000000,?,75570F10,?,00000000,?,0047A445), ref: 0047E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,75570F10,?,00000000,?,0047A445), ref: 0047E583
CloseHandle.KERNEL32(00000000,?,75570F10,?,00000000,?,0047A445), ref: 0047E5B2

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 8a32fef483d3cb84df1b1f710c8d523580e91cc3b55368d3d4ee1da5582d4661
Instruction ID: a30f2a4400421859d98c28583d7700a7d85d5ed0e24a33bee63d8471a8752342
Opcode Fuzzy Hash: 8a32fef483d3cb84df1b1f710c8d523580e91cc3b55368d3d4ee1da5582d4661
Instruction Fuzzy Hash: 9F21F8B19402007AE1207A635D06FDF391CDF55B58F104A6FBE0DA51E3E95DE91082FD

Function 0047877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 004788A5

Part of subcall function 0047F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0047E342,00000000,7568EA50,80000001,00000000,0047E513,?,00000000,00000000,?,000000E4), ref: 0047F089
Part of subcall function 0047F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0047E342,00000000,7568EA50,80000001,00000000,0047E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0047F093

Strings

localcfg, xrefs: 004787CA, 004787CF, 004787FB, 00478835, 00478861
rresolv, xrefs: 004787F6, 0047885C

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 84840fd317149c3e90fb8e8c63ef4f56735e942f38285c304565b853f75b5cbb
Instruction ID: 13c23e9ba86e841eff22206d4bf47b857609b6400d750656878b2ecba5a8e8cb
Opcode Fuzzy Hash: 84840fd317149c3e90fb8e8c63ef4f56735e942f38285c304565b853f75b5cbb
Instruction Fuzzy Hash: 4221B8315883406AF315B7666E47BEE36989B05714FA1882FF70C961C3DEDD454482BF

Function 00474000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004822F8,004742B6,00000000,00000001,004822F8,00000000,?,004798FD), ref: 00474021
GetLastError.KERNEL32(?,004798FD,00000001,00000100,004822F8,0047A3C7), ref: 0047402C
Sleep.KERNEL32(000001F4,?,004798FD,00000001,00000100,004822F8,0047A3C7), ref: 00474046

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: ae2e83a6bcad2ff7e661f0d759feb40ca94e0b541a84ac9aef98428f0d582479
Instruction ID: 416da7b7ff73380dd53926ae3e9d54fcdc6f5940a5b011799e3bb9db0c659c6b
Opcode Fuzzy Hash: ae2e83a6bcad2ff7e661f0d759feb40ca94e0b541a84ac9aef98428f0d582479
Instruction Fuzzy Hash: 56F05E322501416AD7710B24AC49BBA72A1DBC3724F258A2AE3A9F21E0C73448859B19

Function 0047DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0047DC19,?,00000104), ref: 0047DB7F
lstrcpyA.KERNEL32(?,004828F8), ref: 0047DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 0047DBC2

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: 6c79120c4aa9804e7118da0068c498ea5db67d8566787e798230d1a89a51902b
Instruction ID: 4405726749b4af837d98c8c5951c63c8611e92359f2a2867b25383254fcf45df
Opcode Fuzzy Hash: 6c79120c4aa9804e7118da0068c498ea5db67d8566787e798230d1a89a51902b
Instruction Fuzzy Hash: 6DF09070510209ABEF209F64ED49FD93B69AB10308F1045A4BB55A40D0D7F2E549CB18

Function 0047EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0047EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0047EC72
GetTickCount.KERNEL32 ref: 0047EC78

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: c7fc5b2858a729d24605abaa69643cdf3723a7bdfd740ebffd957825dbda8279
Instruction ID: bdab478b95d3b9990ea363af5206eb3730bf50f396bbc2691bc73568230117e2
Opcode Fuzzy Hash: c7fc5b2858a729d24605abaa69643cdf3723a7bdfd740ebffd957825dbda8279
Instruction Fuzzy Hash: 59E0BFF5820104BFE751EBB4EC4EE7F77BCFB08715F500A64B911D6090EA709A099B64

Function 00471978 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 00471992

Strings

`4u, xrefs: 00471992

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID: `4u
API String ID: 2781271927-6339388
Opcode ID: 663d84bae553ec76e499f7c8c20f5ddb6312293fbb90d31eb5d61efa24628e7a
Instruction ID: 1aa5cb9062fe693423af5df91e52dfe0bf3c717552c5b2bb447ab7eb3af99649
Opcode Fuzzy Hash: 663d84bae553ec76e499f7c8c20f5ddb6312293fbb90d31eb5d61efa24628e7a
Instruction Fuzzy Hash: FED012B61486316A52512759BC054BFEB9CDF45662711C42FFD4CC0160D638CC428399

Function 004730B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 004730D8
gethostbyname.WS2_32(?), ref: 004730E2

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: e3dc880f061409bb7b6e57772e401157fbfcc85cb207e0e8e5772a2f1ea049bb
Instruction ID: 8fc0a44aa051a02391bf52365823ea1c512efc1ae86e43906d4cde53bffe359d
Opcode Fuzzy Hash: e3dc880f061409bb7b6e57772e401157fbfcc85cb207e0e8e5772a2f1ea049bb
Instruction Fuzzy Hash: 18E065719001199BCB009BA8EC89FCA77ACBB04318F084565F905E3255EA74E9088794

Function 0047EBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,7FFF0001,80000001,?,0047DB55,7FFF0001), ref: 0047EC13
RtlReAllocateHeap.NTDLL(00000000,?,0047DB55,7FFF0001), ref: 0047EC1A

Part of subcall function 0047EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0047EBFE,7FFF0001,?,0047DB55,7FFF0001), ref: 0047EBD3
Part of subcall function 0047EBCC: RtlAllocateHeap.NTDLL(00000000,?,0047DB55,7FFF0001), ref: 0047EBDA

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 11bd46f8f55ac12ec3249c88cda30055fae4f213ab9ce3c8b9a869d627c07599
Instruction ID: f627a273dc965799aa94f5b11bd4a8fcd3a73af703194495f990db4228cf5b14
Opcode Fuzzy Hash: 11bd46f8f55ac12ec3249c88cda30055fae4f213ab9ce3c8b9a869d627c07599
Instruction Fuzzy Hash: 44E092320042087ACF412B92EC09ADD3F59DF08375F00C16AF90C48060CB369990D788

Function 0047EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0047EBFE,7FFF0001,?,0047DB55,7FFF0001), ref: 0047EBD3
RtlAllocateHeap.NTDLL(00000000,?,0047DB55,7FFF0001), ref: 0047EBDA

Part of subcall function 0047EB74: GetProcessHeap.KERNEL32(00000000,00000000,0047EC28,00000000,?,0047DB55,7FFF0001), ref: 0047EB81
Part of subcall function 0047EB74: HeapSize.KERNEL32(00000000,?,0047DB55,7FFF0001), ref: 0047EB88

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ffc1a3832983ea90069ce3d01e12d7c9503c8f083b85e3f1ca1a59bf4e7d66b5
Instruction ID: 5320d1ecffe15cf8530675479150dc53bdf6ddf7c498177e5e04bf545b192744
Opcode Fuzzy Hash: ffc1a3832983ea90069ce3d01e12d7c9503c8f083b85e3f1ca1a59bf4e7d66b5
Instruction Fuzzy Hash: 6BC08C332082206BC68127A5BC0CEDE3E98EF087B2F08496EF609C2160CB35484087AA

Function 0047F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,0047CA44), ref: 0047F476

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 90c73950946add28e7b8bde8afd9a666ef753ba456a1113e605abce505cca08b
Instruction ID: 7c8f994d94c4f9972ed638fc3c73902d6a8d974e47911c9fed84083557cd3b45
Opcode Fuzzy Hash: 90c73950946add28e7b8bde8afd9a666ef753ba456a1113e605abce505cca08b
Instruction Fuzzy Hash: 62F08C3220054AAB9B119E9ADC84CEB3BAEFB993207044532FA08D3110D631E8298BB4

Function 0047DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 0047DDB5

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: f6fd1934a367eaa0acb9f1e71454c56972848b656c2fa9f5b19d51b3b7b9c778
Instruction ID: abdafc38f1f0d651e07d94bf907ce9225f4aa9bc7b6da1cc6b4180b6cff00b3d
Opcode Fuzzy Hash: f6fd1934a367eaa0acb9f1e71454c56972848b656c2fa9f5b19d51b3b7b9c778
Instruction Fuzzy Hash: 8FF05836A202028FCB308E64998469BB7F8EF86325B14883FE25D92250D738DC49CB19

Non-executed Functions

Function 0047637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00479816,EntryPoint), ref: 0047638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00479816,EntryPoint), ref: 004763A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004763CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004763EB

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: a2bfa4e602d76a08145a432c98f079942da7c44ca715ae9c803c8638f1902c3f
Instruction ID: 5be7e835dc835a7c03bc5ef9bb5ef71f90bd28b4ccce97496a8e2463920aef84
Opcode Fuzzy Hash: a2bfa4e602d76a08145a432c98f079942da7c44ca715ae9c803c8638f1902c3f
Instruction Fuzzy Hash: 721191B2600219BFDB519F65DC49FDB3BA8EF047A4F118469F908E6290D671DD00CBA8

Function 00471000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00471839,00479646), ref: 00471012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004710C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004710E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00471101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00471121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00471140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00471160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00471180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0047119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004711BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004711DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004711FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0047121A

Strings

ntdll.dll, xrefs: 0047100D
RtlInitUnicodeString, xrefs: 00471135
NtOpenProcessToken, xrefs: 004711D4
NtDuplicateToken, xrefs: 004711F3
RtlFreeSid, xrefs: 00471116
NtSetInformationThread, xrefs: 00471155
RtlNtStatusToDosError, xrefs: 00471194
RtlExpandEnvironmentStrings_U, xrefs: 004710BC
RtlLengthSid, xrefs: 00471246
RtlSetLastWin32Error, xrefs: 004710D6
NtFilterToken, xrefs: 0047122B
NtTerminateProcess, xrefs: 004710F6
NtClose, xrefs: 004711B4
NtQueryInformationToken, xrefs: 00471262
RtlAllocateAndInitializeSid, xrefs: 0047120F
NtSetInformationToken, xrefs: 00471175

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 8a474ca733a2b8c2d8597d2eb89e09d9028c7007d453f1a6c599ea7199662988
Instruction ID: dbe9307e1418f413b85b8c69db1a5edd674ff888a1cd1c526c65f8c637907742
Opcode Fuzzy Hash: 8a474ca733a2b8c2d8597d2eb89e09d9028c7007d453f1a6c599ea7199662988
Instruction Fuzzy Hash: 55514DB1502641AAC7209F6CEC44B9E36B86748B22F154B7BD524D22F0D7F8CE82CB5D

Function 0047B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0047B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0047B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0047B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0047B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0047B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0047B329
wsprintfA.USER32 ref: 0047B3B7

Strings

Aug, xrefs: 0047B287
Dec, xrefs: 0047B2A3
Sun, xrefs: 0047B225
Wed, xrefs: 0047B23A
Apr, xrefs: 0047B26B
Tue, xrefs: 0047B233
Nov, xrefs: 0047B29C
Jul, xrefs: 0047B280
Oct, xrefs: 0047B295
Mar, xrefs: 0047B264
Jan, xrefs: 0047B256
Fri, xrefs: 0047B248
Sat, xrefs: 0047B24F
May, xrefs: 0047B272
Sep, xrefs: 0047B28E
Feb, xrefs: 0047B25D
Thu, xrefs: 0047B241
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0047B3AF
Mon, xrefs: 0047B22C
Jun, xrefs: 0047B279

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: d008ba5a16c1d91b202eab36d38e8adc12cec190ecb3680dd8957d084392ee2e
Instruction ID: 5d03db125c1fac50380a606095b182f738c96edbf3489847fa216ad309b3cf12
Opcode Fuzzy Hash: d008ba5a16c1d91b202eab36d38e8adc12cec190ecb3680dd8957d084392ee2e
Instruction Fuzzy Hash: 4D5153B1D1021CAACF58EFD5D8885EEBBB9FF48304F10896BE515B6150D3784A8DCB98

Function 00476511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0047654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0047655C
htonl.WS2_32(?), ref: 00476578
htonl.WS2_32(?), ref: 00476587
wsprintfA.USER32 ref: 0047659B
wsprintfA.USER32 ref: 004765DC
wsprintfA.USER32 ref: 00476671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0047668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00476696
wsprintfA.USER32 ref: 004766B0
wsprintfA.USER32 ref: 004766E7
wsprintfA.USER32 ref: 004766FF
wsprintfA.USER32 ref: 0047671F
ExitProcess.KERNEL32 ref: 00476755

Strings

localcfg, xrefs: 0047672D
except_info, xrefs: 00476728
%d=%p, xrefs: 004766F9
va=%08X%08X uef=%p, xrefs: 00476595
plgs:, xrefs: 004766AA
ver=%d date=%s %sc=%08x a=%p, xrefs: 00476547
Jan 13 2018, xrefs: 0047653A
12:08:32, xrefs: 00476535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004765D6
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0047666B

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: f1606bd093cfb48008e4acae962c4f43da0c5137f9097c5b607b776d2ed92270
Instruction ID: bd30fa04109874dc7bf262c21cb72775bd2e39ff0135fd05d7c8360b8c00a8cf
Opcode Fuzzy Hash: f1606bd093cfb48008e4acae962c4f43da0c5137f9097c5b607b776d2ed92270
Instruction Fuzzy Hash: 38617E72950208AFDB60AFB4DC45FEE77E9FF08300F24846AF96CD2161EA7599448F64

Function 0047A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0047A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0047A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0047A893
wsprintfA.USER32 ref: 0047A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0047A8D2
wsprintfA.USER32 ref: 0047A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0047A97C
wsprintfA.USER32 ref: 0047A9B9

Strings

Error sending command (sent = %d/%d), xrefs: 0047A8A7, 0047A8DA
Too small respons, xrefs: 0047A9C9
AUTH LOGIN, xrefs: 0047A80C
., xrefs: 0047A8CA
data, xrefs: 0047A85E
ehlo %s, xrefs: 0047A7F5
localcfg, xrefs: 0047AB0B
Incorrect respons, xrefs: 0047AB39
Too big smtp respons (%d bytes), xrefs: 0047A9B1
quit, xrefs: 0047A86C
rcpt to:<%s>, xrefs: 0047A855
ESMTP, xrefs: 0047AA38
helo %s, xrefs: 0047A803
mail from:<%s>, xrefs: 0047A848

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 48c12ba0ebb6aaea980e23edac174875039e8bce6737b4c845113f269a4858bb
Instruction ID: d11d68f7b70877e7066325b69d7ccf917f316f969f8067db6311f8495d53395e
Opcode Fuzzy Hash: 48c12ba0ebb6aaea980e23edac174875039e8bce6737b4c845113f269a4858bb
Instruction Fuzzy Hash: 32A14A71904305AADF209B58DC85FEF3769EB80304F24C86BFA0D66190EA3D9D69875F

Function 00472A62 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7556F380), ref: 00472A83
HeapAlloc.KERNEL32(00000000,?,7556F380), ref: 00472A86
socket.WS2_32(00000002,00000002,00000011), ref: 00472AA0
htons.WS2_32(00000000), ref: 00472ADB
select.WS2_32 ref: 00472B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00472B4A
htons.WS2_32(?), ref: 00472B71
htons.WS2_32(?), ref: 00472B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00472BFB

Strings

`4u, xrefs: 00472CC7

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: `4u
API String ID: 1639031587-6339388
Opcode ID: dd538b1f31f2e73e7b450dea9bee43b79d390a300f91991b6a2078e5a1317050
Instruction ID: 5f2aecf10795523bf89e0f9887ae1d9188165a266af96ab781771e42202c0780
Opcode Fuzzy Hash: dd538b1f31f2e73e7b450dea9bee43b79d390a300f91991b6a2078e5a1317050
Instruction Fuzzy Hash: 3D61F2719043049FC3219F61DE08BAFBBE8FB58750F04881EF98997250D7F8D8448BAA

Function 00471280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0047139A
lstrlenW.KERNEL32(-00000003), ref: 00471571

Strings

PDv, xrefs: 0047139A
@, xrefs: 00471380
, xrefs: 00471462
%systemroot%\system32\cmd.exe, xrefs: 00471316
wusa.exe, xrefs: 00471388
D, xrefs: 004715C6
<, xrefs: 00471378
useless, xrefs: 0047161E
uac, xrefs: 00471628

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDv$uac$useless$wusa.exe
API String ID: 1628651668-868794581
Opcode ID: 058ba627ea86aed500c40a8a104fd99b9f561fa269d2c587b522ebfa136e3942
Instruction ID: 01c080f284f227b94874aeac6da6d18f1ecdf21611d155f1473bee8a1eff9e40
Opcode Fuzzy Hash: 058ba627ea86aed500c40a8a104fd99b9f561fa269d2c587b522ebfa136e3942
Instruction Fuzzy Hash: F6F18EB55083419FD324DF68C888BABB7E4FB88704F108D2EF59A97360D7789944CB5A

Function 00472DF2 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,755723A0,?,000DBBA0,?,00000000,00472F0F,?,004720FF,00482000), ref: 00472E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00472F0F,?,004720FF,00482000), ref: 00472E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00472E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00472F0F,?,004720FF,00482000), ref: 00472E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00472F0F,?,004720FF,00482000), ref: 00472E4F
htons.WS2_32(00000035), ref: 00472E88
inet_addr.WS2_32(?), ref: 00472E93
gethostbyname.WS2_32(?), ref: 00472EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00472F0F,?,004720FF,00482000), ref: 00472EE3
HeapFree.KERNEL32(00000000,?,00000000,00472F0F,?,004720FF,00482000), ref: 00472EE6

Strings

iphlpapi.dll, xrefs: 00472DFB, 00472E00, 00472E10
GetNetworkParams, xrefs: 00472E28
W4u, xrefs: 00472E93

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$W4u
API String ID: 929413710-1050870963
Opcode ID: f1882fa3cc5afbf5f2605651fbcfdece5adee8c5abecb699a5490187ed9b8d84
Instruction ID: 59872f714588a67fa4adaa8424e8074dedb86c87e38219cf34943e4c303b6c65
Opcode Fuzzy Hash: f1882fa3cc5afbf5f2605651fbcfdece5adee8c5abecb699a5490187ed9b8d84
Instruction Fuzzy Hash: 7131F631900209ABDB519BB89D48AEF77B8AF04720F14852AF918E3390D7B8CD418B5C

Function 0047704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75570F10,?,75570F10,00000000), ref: 004770C2
RegEnumValueA.ADVAPI32(75570F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75570F10,00000000), ref: 0047719E
RegCloseKey.ADVAPI32(75570F10,?,75570F10,00000000), ref: 004771B2
RegCloseKey.ADVAPI32(75570F10), ref: 00477208
RegCloseKey.ADVAPI32(75570F10), ref: 00477291
___ascii_stricmp.LIBCMT ref: 004772C2
RegCloseKey.ADVAPI32(75570F10), ref: 004772D0
RegCloseKey.ADVAPI32(75570F10), ref: 00477314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0047738D
RegCloseKey.ADVAPI32(75570F10), ref: 004773D8

Part of subcall function 0047F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004822F8,000000C8,00477150,?), ref: 0047F1AD

Strings

", xrefs: 00477227
, xrefs: 00477194

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 8d959129c54cc3a081a46c860dcb22c1efac151185084e2f96fce75074e18f14
Instruction ID: 73b9b974c402f4339dc6e7ec252c026f2404723dba30465d4aa0e5148eb7f5ef
Opcode Fuzzy Hash: 8d959129c54cc3a081a46c860dcb22c1efac151185084e2f96fce75074e18f14
Instruction Fuzzy Hash: 5EB1D471804209BEDF149FA1DC45BEF77B8EF04304F5089ABF508E2191EB799A84CB68

Function 0047AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0047AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0047ADA6

Part of subcall function 0047AD08: gethostname.WS2_32(?,00000080), ref: 0047AD1C
Part of subcall function 0047AD08: lstrlenA.KERNEL32(00000000), ref: 0047AD60
Part of subcall function 0047AD08: lstrlenA.KERNEL32(00000000), ref: 0047AD69
Part of subcall function 0047AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0047AD7F

Part of subcall function 004730B5: gethostname.WS2_32(?,00000080), ref: 004730D8
Part of subcall function 004730B5: gethostbyname.WS2_32(?), ref: 004730E2

wsprintfA.USER32 ref: 0047AEA5

Part of subcall function 0047A7A3: inet_ntoa.WS2_32(?), ref: 0047A7A9

wsprintfA.USER32 ref: 0047AE4F
wsprintfA.USER32 ref: 0047AE5E

Part of subcall function 0047EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0047EF92
Part of subcall function 0047EF7C: lstrlenA.KERNEL32(?), ref: 0047EF99
Part of subcall function 0047EF7C: lstrlenA.KERNEL32(00000000), ref: 0047EFA0

Strings

%s%d, xrefs: 0047AE58
%OUTLOOK_HST, xrefs: 0047AEC5
%OUTLOOK_MID, xrefs: 0047AEAE
%OUTLOOK_BND_, xrefs: 0047AE0F, 0047AE14, 0047AE57, 0047AE76
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0047AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0047AE9F
127.0.0.1, xrefs: 0047ADEB

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: a6e2834a3d9338f0cfd1492ef23b775db810187dad77081dae929f42eae6eea9
Instruction ID: c335b2f13dd78eccbbb5a11242e40895fe0e0f466ae0b124c237ada4cb2c8956
Opcode Fuzzy Hash: a6e2834a3d9338f0cfd1492ef23b775db810187dad77081dae929f42eae6eea9
Instruction Fuzzy Hash: A04153B280020C6BDF25EFA1CC45EEF37ADFF48314F14495BF91992151E635E9188B55

Function 00479326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00479DD7,?,00000022,?,?,00000000,00000001), ref: 00479340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00479DD7,?,00000022,?,?,00000000,00000001), ref: 0047936E
GetModuleFileNameA.KERNEL32(00000000,?,00479DD7,?,00000022,?,?,00000000,00000001), ref: 00479375
wsprintfA.USER32 ref: 004793CE
wsprintfA.USER32 ref: 0047940C
wsprintfA.USER32 ref: 0047948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004794F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00479526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00479571

Strings

runas, xrefs: 00479674

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: ce94ba33169548a8ed661dc0c3471461296492be6588a40bab3789f6b965bd8e
Instruction ID: 1777676af6c49455d6a04c479aa96e04909203a7bbfac45336f845abb5645186
Opcode Fuzzy Hash: ce94ba33169548a8ed661dc0c3471461296492be6588a40bab3789f6b965bd8e
Instruction Fuzzy Hash: 4EA181B2940208AFEB21DFA1CD45FDF3BACEB04744F20852BFA1992151D779D944CBA9

Function 0047B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0047B467

Part of subcall function 0047EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0047EF92
Part of subcall function 0047EF7C: lstrlenA.KERNEL32(?), ref: 0047EF99
Part of subcall function 0047EF7C: lstrlenA.KERNEL32(00000000), ref: 0047EFA0

Strings

%TO_DOMAIN, xrefs: 0047B44B
%TO_EMAIL, xrefs: 0047B473
%FROM_DOMAIN, xrefs: 0047B41E
%P5DATE, xrefs: 0047B4F2
%s@%s, xrefs: 0047B461
%FROM_EMAIL, xrefs: 0047B3E9
%DATE, xrefs: 0047B4D2
%TO_USER, xrefs: 0047B488
%FROM_USER, xrefs: 0047B431
%TO_HASH, xrefs: 0047B4B0
%M5DATE, xrefs: 0047B50F

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: ac7b1cf3f4a6178b3b4dc0a5dc99f4213c2ae05b81740e8b6414d51474dfe101
Instruction ID: 5eed14e510c4cd109018c7d309f81d4811750ed916698a03424335692d5e46ba
Opcode Fuzzy Hash: ac7b1cf3f4a6178b3b4dc0a5dc99f4213c2ae05b81740e8b6414d51474dfe101
Instruction Fuzzy Hash: 554172B254011C7EDF01BEA6CCC2DFF7B6CEF4935CB14451AF908A2142DB78A91887A9

Function 00472011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00472078
GetTickCount.KERNEL32 ref: 004720D4
GetTickCount.KERNEL32 ref: 004720DB
GetTickCount.KERNEL32 ref: 0047212B
GetTickCount.KERNEL32 ref: 00472132
GetTickCount.KERNEL32 ref: 00472142

Part of subcall function 0047F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0047E342,00000000,7568EA50,80000001,00000000,0047E513,?,00000000,00000000,?,000000E4), ref: 0047F089
Part of subcall function 0047F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0047E342,00000000,7568EA50,80000001,00000000,0047E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0047F093

Part of subcall function 0047E854: lstrcpyA.KERNEL32(00000001,?,?,0047D8DF,00000001,localcfg,except_info,00100000,00480264), ref: 0047E88B
Part of subcall function 0047E854: lstrlenA.KERNEL32(00000001,?,0047D8DF,00000001,localcfg,except_info,00100000,00480264), ref: 0047E899

Part of subcall function 00471C5F: wsprintfA.USER32 ref: 00471CE1

Strings

localcfg, xrefs: 00472070, 00472160, 00472186, 00472194, 004721E4
net_type, xrefs: 004721DF
rbl_bl, xrefs: 00472181
rbl_ip, xrefs: 0047218F

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: acd911679b932ffc76e9a1a3550d3c13f896edb542255bff2f962c44879750cb
Instruction ID: d3c81f3928c5d4dde5fe6f41c4b6bb5ffac1c9a5225c75cfdd8336b769040eeb
Opcode Fuzzy Hash: acd911679b932ffc76e9a1a3550d3c13f896edb542255bff2f962c44879750cb
Instruction Fuzzy Hash: 5751F3719003855ED728EB25EF45B9A3BD4FB01318F10886FEB09962A2DBF89448C72D

Function 0047C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0047A4C7: GetTickCount.KERNEL32 ref: 0047A4D1
Part of subcall function 0047A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0047A4FA

GetTickCount.KERNEL32 ref: 0047C31F
GetTickCount.KERNEL32 ref: 0047C32B
GetTickCount.KERNEL32 ref: 0047C363
GetTickCount.KERNEL32 ref: 0047C378
GetTickCount.KERNEL32 ref: 0047C44D
InterlockedIncrement.KERNEL32(0047C4E4), ref: 0047C4AE
CreateThread.KERNEL32(00000000,00000000,0047B535,00000000,?,0047C4E0), ref: 0047C4C1
CloseHandle.KERNEL32(00000000,?,0047C4E0,00483588,00478810), ref: 0047C4CC

Strings

localcfg, xrefs: 0047C2DD

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 56a18421d5d138ff414b3b096aec7fa148bffc1b390092d33fbec1ab068bb2a6
Instruction ID: e7fdc6fe2bc883137a2d293ef4a58ae176bb3d8d06ab13e33e5f326a474e7036
Opcode Fuzzy Hash: 56a18421d5d138ff414b3b096aec7fa148bffc1b390092d33fbec1ab068bb2a6
Instruction Fuzzy Hash: F7515AB1A00B418FD7648F6AC6D456ABBE9FB48304B509D3FE58BC7A90D778F8448B14

Function 0047BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0047BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0047BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0047BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0047BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0047BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0047BF94

Strings

smtp_herr, xrefs: 0047BE46, 0047BF62
smtp_retr, xrefs: 0047BE61, 0047BF8C
smtp_ban, xrefs: 0047BE55, 0047BF77

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: d5ada36c6120a52c20b5bf7e0795bf3933ad3181f54b3006e8e1164340c5224d
Instruction ID: 8ba4377186a2ec48e7a0225240b1d288a5bbf435fa2f8c115b3075d67ad2f756
Opcode Fuzzy Hash: d5ada36c6120a52c20b5bf7e0795bf3933ad3181f54b3006e8e1164340c5224d
Instruction Fuzzy Hash: D0519F31A00216AEDB119F65CD40BDE7BA9EF04748F14C46BE849EB351E738E9458FD8

Function 00476A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75568A60,?,?,?,?,00479A60,?,?,00479E9D), ref: 00476A7D
GetDiskFreeSpaceA.KERNEL32(00479E9D,00479A60,?,?,?,004822F8,?,?,?,00479A60,?,?,00479E9D), ref: 00476ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00479A60,?,?,00479E9D), ref: 00476B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00479A60,?,?,00479E9D), ref: 00476B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00479A60,?,?,00479E9D), ref: 00476B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00479A60,?,?,00479E9D), ref: 00476B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00479A60,?,?,00479E9D), ref: 00476B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00479A60,?,?,00479E9D), ref: 00476B80
GetLastError.KERNEL32(?,?,?,00479A60,?,?,00479E9D,?,?,?,?,?,00479E9D,?,00000022,?), ref: 00476B96

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: be21564a887e3f4b61fcd1c6bea27518eaa4275719aadb7e8e3b043d1a6627e5
Instruction ID: 0049a6073c63a08be38a5d42da3d0be4c58222fc000dc973d5f89098eed8b2f1
Opcode Fuzzy Hash: be21564a887e3f4b61fcd1c6bea27518eaa4275719aadb7e8e3b043d1a6627e5
Instruction Fuzzy Hash: 923123B290010DBFCB019FA09D44ADF7BBAEF4A300F15887BE619E3211D734A9459F69

Function 00476F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0047D7C3), ref: 00476F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0047D7C3), ref: 00476FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00476FE8
LocalFree.KERNEL32(00000120), ref: 0047701F
wsprintfA.USER32 ref: 00477036

Strings

/%d, xrefs: 00477030
|, xrefs: 00476FB3

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: e185b4367d9fe26862458f65dabdfc37bfa210c4c61a762abb9c976946544991
Instruction ID: ff9c4238994f284948f490e47f767fa69f93f9eedd676858b119641f91207f14
Opcode Fuzzy Hash: e185b4367d9fe26862458f65dabdfc37bfa210c4c61a762abb9c976946544991
Instruction Fuzzy Hash: 47313E72500108ABDB01DFA5D849ADF7BBCEF04314F14C56AF909DB201EA39D6088B98

Function 00476CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004822F8,000000E4,00476DDC,000000C8), ref: 00476CE7
GetProcAddress.KERNEL32(00000000), ref: 00476CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00476D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00476D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00476CDD
C:\Windows\SysWOW64\, xrefs: 00476CC9, 00476CD1, 00476CFE, 00476D05, 00476D13, 00476D1E, 00476D2A, 00476D42, 00476D5F, 00476D85
kernel32, xrefs: 00476CE2

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: b2262163de09c3fc555ea7f2e53e6aad3bf1567c87bba031a45e62c42c6ae4a5
Instruction ID: 33701ba82f2de626a12cfc60a40cc3ccbf9ca2acf72d2710cf8cdf0c6d8c11a8
Opcode Fuzzy Hash: b2262163de09c3fc555ea7f2e53e6aad3bf1567c87bba031a45e62c42c6ae4a5
Instruction Fuzzy Hash: 35213731750A4039F77167324D89FFF2E8E9F12714F09889AF80CA6281D6DD884983AD

Function 0047977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00479947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004822F8), ref: 004797B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004822F8), ref: 004797EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004822F8), ref: 004797F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004822F8), ref: 00479831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004822F8), ref: 0047984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,004822F8), ref: 0047985B

Strings

D, xrefs: 004797A9

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: cc21270c9f7039f9aaf8cc256c724bf42cab13a46e57438aea26a378f23b50a6
Instruction ID: bd79ccd4e2bba8f006fe01733c0666858a34805c781ea2759edf212dda4545e8
Opcode Fuzzy Hash: cc21270c9f7039f9aaf8cc256c724bf42cab13a46e57438aea26a378f23b50a6
Instruction Fuzzy Hash: FD218B71911219BBDB119FA1DC49EEF7BBCEF09760F004466BA1CE1150EB359A44CBA8

Function 0047E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047DD05: GetTickCount.KERNEL32 ref: 0047DD0F
Part of subcall function 0047DD05: InterlockedExchange.KERNEL32(004836B4,00000001), ref: 0047DD44
Part of subcall function 0047DD05: GetCurrentThreadId.KERNEL32 ref: 0047DD53

Part of subcall function 0047DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0047DDB5

lstrcpynA.KERNEL32(?,00471E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0047EAAA,?,?), ref: 0047E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0047EAAA,?,?,00000001,?,00471E84,?), ref: 0047E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0047EAAA,?,?,00000001,?,00471E84,?,0000000A), ref: 0047E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0047EAAA,?,?,00000001,?,00471E84,?), ref: 0047E94F

Strings

localcfg, xrefs: 0047E8AB
flags_upd, xrefs: 0047E8A7

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 41fa33d76dffa818fbc77189caef9d63d398a25fa5c134dbd5ce23a04a60ffa0
Instruction ID: 7a4059d6177eb2001c9da0b7b2b217bd2e54a7b5a9fc0271f359d590a8e51ee9
Opcode Fuzzy Hash: 41fa33d76dffa818fbc77189caef9d63d398a25fa5c134dbd5ce23a04a60ffa0
Instruction Fuzzy Hash: D2514072D00209AFCB11EFA9C985DEEB7F9FF48308F14466EE409A7211D778EA158B54

Function 00476BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00476BB2

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 30b1e8f0d8214c6b44f2851de8b5f0fae3f58fcff66a94e45e6dbd82f55186ba
Instruction ID: 8871e8cfbc2ab05f0339105dc5886e8033007f0485a00536862c18de7a1900cb
Opcode Fuzzy Hash: 30b1e8f0d8214c6b44f2851de8b5f0fae3f58fcff66a94e45e6dbd82f55186ba
Instruction Fuzzy Hash: 6A21D176100505FFDB125B61FD49EDF3BADDB06764B21892AF506E1091EB349A00977C

Function 00479064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004822F8), ref: 0047907B
wsprintfA.USER32 ref: 004790E9
CreateFileA.KERNEL32(004822F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0047910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00479122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0047912D
CloseHandle.KERNEL32(00000000), ref: 00479134

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: bae86584aaed77b942dd1315248a439ddeab655290a56e5074ae2b2980c81b55
Instruction ID: e2bf5865220db0145bb0836bf99308183defde9a795daddb21b2a1d7914f88e7
Opcode Fuzzy Hash: bae86584aaed77b942dd1315248a439ddeab655290a56e5074ae2b2980c81b55
Instruction Fuzzy Hash: D51105B66000107EE7646723EC0EFEF366DCBC9704F00C56ABB0AA1051EA744A0597A8

Function 0047DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047DD0F
GetCurrentThreadId.KERNEL32 ref: 0047DD20
GetTickCount.KERNEL32 ref: 0047DD2E
Sleep.KERNEL32(00000000,?,75570F10,?,00000000,0047E538,?,75570F10,?,00000000,?,0047A445), ref: 0047DD3B
InterlockedExchange.KERNEL32(004836B4,00000001), ref: 0047DD44
GetCurrentThreadId.KERNEL32 ref: 0047DD53

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 036cf73b696f68dc925447e141621f8a388c4774ed001d1009554ed0924df67e
Instruction ID: fa539534674e64c345c8113a00200f218d91bccf86eaa4792048107900824788
Opcode Fuzzy Hash: 036cf73b696f68dc925447e141621f8a388c4774ed001d1009554ed0924df67e
Instruction Fuzzy Hash: A4F02E32524200AFC3A05F68FC84B6D3BB4FF01B12F10883EE60DE2220D32850498F6E

Function 0047AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0047AD1C
lstrlenA.KERNEL32(00000000), ref: 0047AD60
lstrlenA.KERNEL32(00000000), ref: 0047AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0047AD7F

Strings

LocalHost, xrefs: 0047AD79

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 44e202605d980a248ce766439a719ba3d09ffde778ae56b98ef3965be1d3ad0b
Instruction ID: a1d076a9eaea9969fffdece68291c5797c7fcdea15e30211eea29e7c1996e7b6
Opcode Fuzzy Hash: 44e202605d980a248ce766439a719ba3d09ffde778ae56b98ef3965be1d3ad0b
Instruction Fuzzy Hash: 2B0149208441895DDF3106289844BEE3F6B5BD770AF10C05BE8C8D7612E65C9897839F

Function 00474280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004798FD,00000001,00000100,004822F8,0047A3C7), ref: 00474290
CloseHandle.KERNEL32(0047A3C7), ref: 004743AB
CloseHandle.KERNEL32(00000001), ref: 004743AE

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 1127580f45fa0cc661fb29f6f057b9719fe144804c5f3d0d108206df0f091808
Instruction ID: 33114a894b7c22d0c27424732062c5ad6ec182f18c24c505da0d83a10e2ab673
Opcode Fuzzy Hash: 1127580f45fa0cc661fb29f6f057b9719fe144804c5f3d0d108206df0f091808
Instruction Fuzzy Hash: 9841A371D00209BADB109FA2CD85FEF7FBCEF40365F10855AF518A6191D7388A45DB64

Function 00476069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004764CF,00000000), ref: 0047609C
LoadLibraryA.KERNEL32(?,?,004764CF,00000000), ref: 004760C3
GetProcAddress.KERNEL32(?,00000014), ref: 0047614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0047619E

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: b5bb673848c3ef6cbd18f773021ac5bb579558f26cf5bca28aee343e7d703f0f
Instruction ID: 5f0c4d4f531c28d2ac37589447e070a508019b79cfa2165badfb5f911474c897
Opcode Fuzzy Hash: b5bb673848c3ef6cbd18f773021ac5bb579558f26cf5bca28aee343e7d703f0f
Instruction Fuzzy Hash: C041BF71A00506AFDB10CF58C888BAAB7BAEF04354F66C16AE809D7391D738ED45CB84

Function 00472923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f0e9ec7c3b669205565ab8ccaac2f6623c4547cac78ff1700a91a76f1a4f10
Instruction ID: 39f71e7fae29ee244fef51278cd48077d910fad31472e32da2223d99f45f71ec
Opcode Fuzzy Hash: 74f0e9ec7c3b669205565ab8ccaac2f6623c4547cac78ff1700a91a76f1a4f10
Instruction Fuzzy Hash: BB319371A00719ABCB109FA6CD81AFEB7F4FF48715F10885BF549E6241E3B8DA418B58

Function 004726FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047272E
htons.WS2_32(00000001), ref: 00472752
htons.WS2_32(0000000F), ref: 004727D5
htons.WS2_32(00000001), ref: 004727E3
sendto.WS2_32(?,00482BF8,00000009,00000000,00000010,00000010), ref: 00472802

Part of subcall function 0047EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0047EBFE,7FFF0001,?,0047DB55,7FFF0001), ref: 0047EBD3
Part of subcall function 0047EBCC: RtlAllocateHeap.NTDLL(00000000,?,0047DB55,7FFF0001), ref: 0047EBDA

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: aba95b600c3037531f079f30675deb829d235ff6b26e67932ecc36d02b131b4d
Instruction ID: dbe85e74d97c303747231be5594cd6b1d33e6039073d306ad39257588cc4d924
Opcode Fuzzy Hash: aba95b600c3037531f079f30675deb829d235ff6b26e67932ecc36d02b131b4d
Instruction Fuzzy Hash: 52314E342413829FD7148F74DD40DAA7764FF19318B15847EDC598B322D6B6E842D718

Function 00479145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004822F8), ref: 0047915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00479166
CharToOemA.USER32(?,?), ref: 00479174
wsprintfA.USER32 ref: 004791A9

Part of subcall function 00479064: GetTempPathA.KERNEL32(00000400,?,00000000,004822F8), ref: 0047907B
Part of subcall function 00479064: wsprintfA.USER32 ref: 004790E9
Part of subcall function 00479064: CreateFileA.KERNEL32(004822F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0047910E
Part of subcall function 00479064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00479122
Part of subcall function 00479064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0047912D
Part of subcall function 00479064: CloseHandle.KERNEL32(00000000), ref: 00479134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004791E1

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: fd80108e70d93732e2561ffd8a0beba3a907ebdc9fd12c72c79d9a90eeb25e0a
Instruction ID: b342aed5cec56fef5abbe008c9aadeedd8154bf377614de7603d0900a63e0746
Opcode Fuzzy Hash: fd80108e70d93732e2561ffd8a0beba3a907ebdc9fd12c72c79d9a90eeb25e0a
Instruction Fuzzy Hash: 1C0192F68001187BD760A7619D8DEDF377CDB85711F0004A6BB09E2040DAB49A888F74

Function 00472419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00472491,?,?,?,0047E844,-00000030,?,?,?,00000001), ref: 00472429
lstrlenA.KERNEL32(?,?,00472491,?,?,?,0047E844,-00000030,?,?,?,00000001,00471E3D,00000001,localcfg,lid_file_upd), ref: 0047243E
lstrcmpiA.KERNEL32(?,?), ref: 00472452
lstrlenA.KERNEL32(?,?,00472491,?,?,?,0047E844,-00000030,?,?,?,00000001,00471E3D,00000001,localcfg,lid_file_upd), ref: 00472467

Strings

localcfg, xrefs: 0047241F

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 7d209d5964a2babf267020d811bac0823d71b1e2653e51a74b3046549e523081
Instruction ID: 08f1501207e68d22098f302c83d30d1f01efca42c2e622242acaf11b91c176e8
Opcode Fuzzy Hash: 7d209d5964a2babf267020d811bac0823d71b1e2653e51a74b3046549e523081
Instruction Fuzzy Hash: 7E011632600218AF8F11EF69DD808DE7BA9EF45394B01C42AE859A7211E374EA448B98

Function 00476EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00476F0F
CheckTokenMembership.ADVAPI32(00000000,?,*pG), ref: 00476F24
FreeSid.ADVAPI32(?), ref: 00476F3E

Strings

*pG, xrefs: 00476F1C, 00476F1F

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *pG
API String ID: 3429775523-219985889
Opcode ID: 1d848716a4dddb59691780c3c6ed80c25f9e32df064fa23b78e15df0f12074f2
Instruction ID: c2043f1e3b342454537786318647386e1a24b093d088922ef051e41dce8500ee
Opcode Fuzzy Hash: 1d848716a4dddb59691780c3c6ed80c25f9e32df064fa23b78e15df0f12074f2
Instruction Fuzzy Hash: BD012171910608AFDB10DFE5ED85AAE7BB9FB04304F10887EE605E2152E7749948DB18

Function 00471C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00471CE1
wsprintfA.USER32 ref: 00471D6B

Strings

localcfg, xrefs: 00471C70
%u.%u.%u.%u.%s, xrefs: 00471CDB, 00471D65

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 94ff60a6bd85a3e8b48985c5a1d8ec5f95ea90d312d91afa23bb526bf3716368
Instruction ID: 1e2881dbffcb2d27fea161af0bf9f7f4a9e3fbb85494596d569f6adf1a4fd72f
Opcode Fuzzy Hash: 94ff60a6bd85a3e8b48985c5a1d8ec5f95ea90d312d91afa23bb526bf3716368
Instruction Fuzzy Hash: 4341BE729042989FDB31DF798D44BEE3BE89F49310F244556FD68D3252D638EA04CBA4

Function 0047E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047DD05: GetTickCount.KERNEL32 ref: 0047DD0F
Part of subcall function 0047DD05: InterlockedExchange.KERNEL32(004836B4,00000001), ref: 0047DD44
Part of subcall function 0047DD05: GetCurrentThreadId.KERNEL32 ref: 0047DD53

lstrcmpA.KERNEL32(75570F18,00000000,?,75570F10,00000000,?,00475EC1), ref: 0047E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75570F10,00000000,?,00475EC1), ref: 0047E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,75570F10,00000000,?,00475EC1), ref: 0047E722

Strings

89ABCDEF, xrefs: 0047E721

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: fa39805e81fd04862bcf4f0b034dd5687cc27a6ae09c7a8231b34fd900cd7490
Instruction ID: 5913194babb2fc8c4280586d6528db48bf682d85653fa8c7df48e72d5bd6639f
Opcode Fuzzy Hash: fa39805e81fd04862bcf4f0b034dd5687cc27a6ae09c7a8231b34fd900cd7490
Instruction Fuzzy Hash: 6431D231900301DBCB358F66D8847DB37E4AF29724F50CAAFE5598B650E778E884CB89

Function 0047E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0047E2A3,00000000,00000000,00000000,00020106,00000000,0047E2A3,00000000,000000E4), ref: 0047E0B2
RegSetValueExA.ADVAPI32(0047E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004822F8), ref: 0047E127
RegDeleteValueA.ADVAPI32(0047E2A3,?,?,?,?,?,000000C8,004822F8), ref: 0047E158
RegCloseKey.ADVAPI32(0047E2A3,?,?,?,?,000000C8,004822F8,?,?,?,?,?,?,?,?,0047E2A3), ref: 0047E161

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 22d166fcc093099837535c8e8996520133381d5d7d8fa7fa58f4247bdf7e27a6
Instruction ID: ffdef05c9f589174715997aca448e39f244b58fe7eeef582201c53c489c89415
Opcode Fuzzy Hash: 22d166fcc093099837535c8e8996520133381d5d7d8fa7fa58f4247bdf7e27a6
Instruction Fuzzy Hash: 3E21A571A00219BBDF209FA6DC89EDF7F79EF09754F0081B6F908E6150E6718A14DB94

Function 00473F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0047A3C7,00000000,00000000,000007D0,00000001), ref: 00473F44
GetLastError.KERNEL32 ref: 00473F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00473F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00473F72

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 6bff2abb4c574d5fe6c5c8dac407c44cdcc555e82c55639255d65c796f411628
Instruction ID: ce3aba0542c2d8f496d4204ba4f1f47db0cf5282734030081d817b3eebf17871
Opcode Fuzzy Hash: 6bff2abb4c574d5fe6c5c8dac407c44cdcc555e82c55639255d65c796f411628
Instruction Fuzzy Hash: 96010C72911109ABDF01DF90ED44BEF7B7CEB04396F104426FA05E2150D734DA159BB6

Function 00473F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0047A3C7,00000000,00000000,000007D0,00000001), ref: 00473FB8
GetLastError.KERNEL32 ref: 00473FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00473FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00473FE6

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 28c54907a1be8214630481bb1188186e53b297b90a969d6383cc29cbb75554f3
Instruction ID: 8927d915d5c451c6d14f9c00e96e9f24ce013d1568300cbdb480fbfdd8f2baa1
Opcode Fuzzy Hash: 28c54907a1be8214630481bb1188186e53b297b90a969d6383cc29cbb75554f3
Instruction Fuzzy Hash: 0D01297292110AABDF01DF90ED45BEF3B7CEB04356F108426F906E2050D734DA149BB6

Function 0047A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047A4D1
GetTickCount.KERNEL32 ref: 0047A4E4
Sleep.KERNEL32(00000000,?,0047C2E9,0047C4E0,00000000,localcfg,?,0047C4E0,00483588,00478810), ref: 0047A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0047A4FA

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: e8d8f0840f66fd8a645b1a123ecdd5c3318ba3e59365865d896efa0af944f954
Instruction ID: 76912af7e363b6c62b2f6076c8ca66f65239f021683ab7b5cf83b24cdcfcb62e
Opcode Fuzzy Hash: e8d8f0840f66fd8a645b1a123ecdd5c3318ba3e59365865d896efa0af944f954
Instruction Fuzzy Hash: 79E026332002046BC6001BB5BD84FAF3388AB8A761F154436FB08D3240C65AA85547BF

Function 00474E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00474E9E
GetTickCount.KERNEL32 ref: 00474EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00474EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00474EC3

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 0dda5647bf2461ffe50c480452975b4e3eb6bb8eeabdf770c730bcd2ef9682fc
Instruction ID: 8379fed3c7d7e40a50d7b45654467b5e2ba364a9cb8b9ed3bef26f8d40bb5a45
Opcode Fuzzy Hash: 0dda5647bf2461ffe50c480452975b4e3eb6bb8eeabdf770c730bcd2ef9682fc
Instruction Fuzzy Hash: 35E086333112145BD61027B9BD84FBA6689AB97371F110936E70DD2180D75A984646BA

Function 00474BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00474BDD
GetTickCount.KERNEL32 ref: 00474BEC
Sleep.KERNEL32(00000000,?,?,?,0081B114,004750F2), ref: 00474BF9
InterlockedExchange.KERNEL32(0081B108,00000001), ref: 00474C02

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 0cca2d58e38932a40d227421a023102e3b79a2982015fcef0ceccd94cd6f7c95
Instruction ID: 08482bbc3f25540a1c649f3c417cf646b5d572b2ed790ca1f43014b27c308d33
Opcode Fuzzy Hash: 0cca2d58e38932a40d227421a023102e3b79a2982015fcef0ceccd94cd6f7c95
Instruction Fuzzy Hash: DCE026332012141BC70013B56D80FAA7398DB86361F024837F70CC2150C65AE84142BA

Function 004730FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00473103
GetTickCount.KERNEL32 ref: 0047310F
Sleep.KERNEL32(00000000), ref: 0047311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00473128

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 68a85d8febe39f04c753e0fffff1198c9ddf3f0c91a446b31b20aa391075f108
Instruction ID: f510af0544df2713334b767b05aa187b770a39e849e9b81bde535aba2fe03724
Opcode Fuzzy Hash: 68a85d8febe39f04c753e0fffff1198c9ddf3f0c91a446b31b20aa391075f108
Instruction Fuzzy Hash: 85E02B32310215AFDB406F75BE84BCE6B9ADF85763F11483BF309D61A0C5544D059B7A

Function 00476987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00479A60,?,?,00000000,00000000,00479A60,?,00000000), ref: 004769F9
WriteFile.KERNEL32(00479A60,?,00479A60,00000000,00000000), ref: 00476A27

Strings

,kG, xrefs: 004769A7, 004769D5

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,kG
API String ID: 3934441357-2695299273
Opcode ID: bd9450b60983889b9392b47b8b6233b599d0ffc3db64f05e3a44fc1d5bff5708
Instruction ID: 907c881ea20139efde69fd68dc86b310b15cd421f62306de3e2e12f4e22bc873
Opcode Fuzzy Hash: bd9450b60983889b9392b47b8b6233b599d0ffc3db64f05e3a44fc1d5bff5708
Instruction Fuzzy Hash: 46315E72600609EFDB14CF69DD84BEA77F5EB04315F11846AE805E7200D374EE54CBA5

Function 00478CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00478D02
GetTickCount.KERNEL32 ref: 00478DA1

Strings

localcfg, xrefs: 00478D19

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: dd2c99fc132c612239e03d2a1dd88646e90a2e6ec32bdfe6b980423c423bdca2
Instruction ID: cf281ac1abe6b5e8612c7b799a7383b2e188ffef1e6e594c379578b825a43ae7
Opcode Fuzzy Hash: dd2c99fc132c612239e03d2a1dd88646e90a2e6ec32bdfe6b980423c423bdca2
Instruction Fuzzy Hash: 8321F032610201AFCB308F64DC996DEBBB9EB21711B29846FD808D7291CF28ED008759

Function 0047BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047BFD0
wsprintfA.USER32 ref: 0047C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0047C057

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 0457a1487b5b68cfea8ba4ef99b60148bc9648d676f19594eb1055729ea4c8a8
Instruction ID: ecd4a2e81b696a21c74ca58d016a147375c64c3655a77d754db080114c89ecc0
Opcode Fuzzy Hash: 0457a1487b5b68cfea8ba4ef99b60148bc9648d676f19594eb1055729ea4c8a8
Instruction Fuzzy Hash: 71119A72100100FFDB429BA9DD44E567FA6FF88318B34859CF6188E166D633D867DB50

Function 004738F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004730FA: GetTickCount.KERNEL32 ref: 00473103
Part of subcall function 004730FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00473128

GetCurrentThreadId.KERNEL32 ref: 00473929
GetCurrentThreadId.KERNEL32 ref: 00473939

Strings

%FROM_EMAIL, xrefs: 00473913

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 2e6b54fe803aaf7ad9c5fc36c99dffab2a3b316d42678ff4512d1c2c165de3ff
Instruction ID: 52337622a95f25bccb2dec4f62a8c718aad539ba616c1aa2e42a6496bf64157f
Opcode Fuzzy Hash: 2e6b54fe803aaf7ad9c5fc36c99dffab2a3b316d42678ff4512d1c2c165de3ff
Instruction Fuzzy Hash: ED111CB1900215EFD720DF16D541A9DF3F4FB04716F10895EE94897251C7B4AA80DFA8

Function 0047AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0047BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0047ABB9
InterlockedIncrement.KERNEL32(00483640), ref: 0047ABE1

Strings

%FROM_EMAIL, xrefs: 0047AB8C

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 4fe6e5fdeb0e38d67f3a3589730f72b8cff14954509f50a603cd6b5ccbb828f8
Instruction ID: 362118851f7d05c1c1a32f9ec4d48e99a4dbf4d8b60f3cd59b0551e6a93b0405
Opcode Fuzzy Hash: 4fe6e5fdeb0e38d67f3a3589730f72b8cff14954509f50a603cd6b5ccbb828f8
Instruction Fuzzy Hash: 1201F5315083C4AFDB21CF2CD881F8A7BA5AF95314F14888AF6845B303C374E954CB96

Function 004726B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004726C3
inet_ntoa.WS2_32(?), ref: 004726E4

Strings

localcfg, xrefs: 004726CD, 004726D2, 004726DE

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 138fb69cd6a02b2ab275ad8cda4fe8aa997fd57b7f9d3afbf677b96655206771
Instruction ID: f5b555a52f258dd8d38512178f94f0c174d30705bdfbb058cb5615d6641a3268
Opcode Fuzzy Hash: 138fb69cd6a02b2ab275ad8cda4fe8aa997fd57b7f9d3afbf677b96655206771
Instruction Fuzzy Hash: 77F082321582097BEB006FA5ED09ADA379CEF08350F108867FA0CCA0A0DBB5D940979C

Function 0047EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0047EB54,_alldiv,0047F0B7,80000001,00000000,00989680,00000000,?,?,?,0047E342,00000000,7568EA50,80000001,00000000), ref: 0047EAF2
GetProcAddress.KERNEL32(773F0000,00000000), ref: 0047EB07

Strings

ntdll.dll, xrefs: 0047EAED

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 9ab894b55bc8d557e59379c5d8d68030b4dcb76fd54efdc020833699e1ccc979
Instruction ID: 7d20867008dccbe6494ad286f557373ea93386b59704022c83e4cb9ac74a7edb
Opcode Fuzzy Hash: 9ab894b55bc8d557e59379c5d8d68030b4dcb76fd54efdc020833699e1ccc979
Instruction Fuzzy Hash: 5AD0C734610302678F61DF699D0ED4E7A986F54B01B408C6AB80AE1620E738D448D70C

Function 00472F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00472D21: GetModuleHandleA.KERNEL32(00000000,755723A0,?,00000000,00472F01,?,004720FF,00482000), ref: 00472D3A
Part of subcall function 00472D21: LoadLibraryA.KERNEL32(?), ref: 00472D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00472F73
HeapFree.KERNEL32(00000000), ref: 00472F7A

Memory Dump Source

Source File: 00000012.00000002.2647907430.0000000000470000.00000040.00000400.00020000.00000000.sdmp, Offset: 00470000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_470000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 7024b28fbba46ba277ad450532ea81f57e4218bc82b77444d10d5200bb2ffb53
Instruction ID: 61865f333913c732c976c7ea18fcc229ba3693c77728e8ce78d0f5cbdc747007
Opcode Fuzzy Hash: 7024b28fbba46ba277ad450532ea81f57e4218bc82b77444d10d5200bb2ffb53
Instruction Fuzzy Hash: A851D27190024A9FCF01DF64DC889FAB775FF19304F14856AEC9AD7210E7369A19DB88

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SGn3RtDC8Y.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ubezyssm.exe

C:\Windows\SysWOW64\jlxopxf\ubezyssm.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
SGn3RtDC8Y.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre